CVE-2007-6581
Social Engine 2.0 - Path Traversal via Global Lang Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-6581. PoCs published by MhZ91.
AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Social Engine v2.0. The vulnerability allows an attacker to include arbitrary local files via the 'global_lang' parameter in multiple PHP scripts, using null byte termination to bypass file extension checks.
Description
Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the global_lang parameter to (1) header_album.php, (2) header_blog.php, or (3) header_group.php; or (4) admin_header_album.php, (5) admin_header_blog.php, or (6) admin_header_group.php in admin/.
Exploits (1)
This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Social Engine v2.0. The vulnerability allows an attacker to include arbitrary local files via the 'global_lang' parameter in multiple PHP scripts, using null byte termination to bypass file extension checks.