CVE-2007-4527

phphq phUploader 1.2 - Unrestricted File Upload and Remote Code Execution

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-4527. PoCs published by wlhaan-hacker.

AI-analyzed exploit summary This is a writeup describing a remote file upload vulnerability in phUploader v2, allowing an attacker to upload a malicious file disguised as a FLAC file to achieve remote code execution. The exploit lacks actual code but provides a method to exploit the vulnerability.

Description

Unrestricted file upload vulnerability in phUploader.php in phphq.Net phUploader 1.2 allows remote attackers to upload and execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Exploits (1)

exploitdb WRITEUP VERIFIED
by wlhaan-hacker · textwebappsphp
https://www.exploit-db.com/exploits/10574

This is a writeup describing a remote file upload vulnerability in phUploader v2, allowing an attacker to upload a malicious file disguised as a FLAC file to achieve remote code execution. The exploit lacks actual code but provides a method to exploit the vulnerability.

Classification
Writeup 80%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: phUploader v2
No auth needed
Prerequisites: Access to the upload.php endpoint · Ability to craft a malicious file with a .flac extension
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/25405
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/45829

Scores

EPSS 0.0534
EPSS Percentile 90.2%

Details

Status published
Products (1)
phphq/phuploader 1.2
Published Aug 25, 2007
Tracked Since Feb 18, 2026