Exploitation Summary
EIP tracks 1 public exploit for CVE-2007-6471. PoCs published by Michael Brooks.
AI-analyzed exploit summary This exploit demonstrates a local file inclusion vulnerability in phPay due to improper input sanitization, allowing unauthorized file access and script execution on Windows systems. The PoC includes URLs that bypass protection mechanisms, especially when 'magic_quotes_gpc' is enabled.
Description
Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks and include and execute arbitrary local files via a ..\ (dot dot backslash) in the config parameter.
Exploits (1)
This exploit demonstrates a local file inclusion vulnerability in phPay due to improper input sanitization, allowing unauthorized file access and script execution on Windows systems. The PoC includes URLs that bypass protection mechanisms, especially when 'magic_quotes_gpc' is enabled.