CVE-2007-6515
SiteScape Forum - Remote Code Execution via TCL Code Separator in Query String
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-6515. PoCs published by Spencer McIntyre, niekt0.
AI-analyzed exploit summary This exploit leverages TCL code injection in SiteScape Enterprise Forums to achieve remote code execution. It supports multiple attack modes including reverse shell, file upload, and file download.
Description
support/dispatch.cgi in SiteScape Forum allows remote attackers to execute arbitrary TCL code via code separator characters in the query string.
Exploits (2)
This exploit leverages TCL code injection in SiteScape Enterprise Forums to achieve remote code execution. It supports multiple attack modes including reverse shell, file upload, and file download.
This exploit demonstrates a command injection vulnerability in SiteScape Forum by appending a semicolon and arbitrary command to the URL. The lack of input sanitization allows execution of system commands in the context of the webserver process.