CVE-2007-4585

2532gigs 1.2.1 - Remote File Inclusion via Language Parameter Path Traversal

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-4585. PoCs published by bd0rk.

AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in 2532|Gigs 1.2.1 via the 'activateuser.php' script. The vulnerability arises from unsanitized user input in the 'language' parameter, allowing path traversal to include arbitrary files.

Description

Directory traversal vulnerability in activateuser.php in 2532|Gigs 1.2.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by bd0rk · textwebappsphp

https://www.exploit-db.com/exploits/4317

View Code ZIP pw:eip

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in 2532|Gigs 1.2.1 via the 'activateuser.php' script. The vulnerability arises from unsanitized user input in the 'language' parameter, allowing path traversal to include arbitrary files.

Classification

Working Poc 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: 2532|Gigs 1.2.1

No auth needed

Prerequisites: Access to the 'activateuser.php' script on the target server

devstral-2 · analyzed Feb 16, 2026 Full analysis →