CVE-2007-5056
ADOdb Lite < 1.42 - Remote Code Execution via last_module Parameter
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2007-5056. PoCs published by GoLd_M, Iron, irk4z.
AI-analyzed exploit summary This exploit targets a remote code execution vulnerability in SAPID CMF Build 87 by manipulating the 'last_module' parameter in 'adodb-perf-module.inc.php'. The PoC demonstrates command injection via the 'passthru' function or shell inclusion.
Description
Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module parameter.
Exploits (5)
This exploit targets a remote code execution vulnerability in SAPID CMF Build 87 by manipulating the 'last_module' parameter in 'adodb-perf-module.inc.php'. The PoC demonstrates command injection via the 'passthru' function or shell inclusion.
This exploit leverages a remote code execution vulnerability in PacerCMS 0.6 by injecting arbitrary PHP code via the 'last_module' parameter in adodb-perf-module.inc.php. The PoC demonstrates command execution (e.g., 'ls') and shell inclusion.
This exploit targets Open-Realty <= 2.4.3 by leveraging a remote code execution vulnerability via a crafted URL. It requires Register_globals to be enabled in PHP and injects arbitrary PHP code through the 'last_module' parameter.
This exploit targets a remote code execution vulnerability in Journalness <= 4.1 by injecting arbitrary PHP code via a crafted URL parameter. It leverages the 'Register_globals = On' PHP configuration to execute the payload.
This exploit leverages a PHP code injection vulnerability in CMS Made Simple 1.1.2 via the `last_module` parameter in `adodb-perf-module.inc.php`, allowing arbitrary code execution through `eval()`. The PoC demonstrates command injection via URL parameters.