CVE-2007-2899
NavBoard 2.6.0 - Remote Code Execution via admin_config.php Parameter Injection
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-2899. PoCs published by Dj7xpl.
AI-analyzed exploit summary This exploit targets a remote code execution vulnerability in NavBoard 2.6.0 by manipulating the 'editconfig' parameter and injecting malicious input into configuration fields. The PoC demonstrates how arbitrary code can be executed by leveraging improper input validation in the admin configuration page.
Description
Direct static code injection vulnerability in admin_config.php in NavBoard 2.6.0 allows remote attackers to inject arbitrary PHP code into data/config.php via multiple parameters, as demonstrated via the threadperpage parameter in an editconfig action.
Exploits (1)
This exploit targets a remote code execution vulnerability in NavBoard 2.6.0 by manipulating the 'editconfig' parameter and injecting malicious input into configuration fields. The PoC demonstrates how arbitrary code can be executed by leveraging improper input validation in the admin configuration page.