CVE-2007-5230
Zomplog <= 3.8.1 - Unauthenticated Administrative Action Execution via Direct Request
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-5230. PoCs published by InATeam.
AI-analyzed exploit summary This PHP script exploits an arbitrary file upload vulnerability in Zomplog <= 3.8.1 by directly accessing the unprotected /admin/upload_files.php endpoint, bypassing authentication, and uploading a malicious file. It handles both directory listing and brute-forcing scenarios to locate the uploaded file.
Description
admin/upload_files.php in Zomplog 3.8.1 and earlier does not check for administrative credentials, which allows remote attackers to perform administrative actions via a direct request. NOTE: this can be leveraged for code execution by exploiting CVE-2007-5231.
Exploits (1)
This PHP script exploits an arbitrary file upload vulnerability in Zomplog <= 3.8.1 by directly accessing the unprotected /admin/upload_files.php endpoint, bypassing authentication, and uploading a malicious file. It handles both directory listing and brute-forcing scenarios to locate the uploaded file.