CVE-2007-4886
AuraCMS 1.x and 2.x - Remote Code Execution via pilih Parameter URL Injection
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-4886. PoCs published by k1tk4t.
AI-analyzed exploit summary This exploit demonstrates a remote file attachment vulnerability in AuraCMS 2.1, allowing arbitrary file uploads to the '/files/' directory, and a local file inclusion vulnerability due to improper input validation in 'index.php'. The PoC includes steps to upload a shell and access sensitive files via path traversal.
Description
Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbitrary PHP code via a (1) UNC share pathname, or a (2) ftp, (3) ftps, or (4) ssh2.sftp URL, in the pilih parameter, for which PHP remote file inclusion is blocked only for http URLs.
Exploits (1)
This exploit demonstrates a remote file attachment vulnerability in AuraCMS 2.1, allowing arbitrary file uploads to the '/files/' directory, and a local file inclusion vulnerability due to improper input validation in 'index.php'. The PoC includes steps to upload a shell and access sensitive files via path traversal.