CVE-2008-0840
Public Warehouse LightBlog 9.6 - Path Traversal via Username Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-0840. PoCs published by muuratsalo.
AI-analyzed exploit summary This exploit demonstrates a local file inclusion (LFI) vulnerability in LightBlog 9.6 by manipulating the 'username' parameter to traverse directories and read arbitrary files (e.g., /etc/passwd). The null byte (%00) is used to terminate the string and bypass file extension checks.
Description
Directory traversal vulnerability in view_member.php in Public Warehouse LightBlog 9.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the username parameter.
Exploits (1)
This exploit demonstrates a local file inclusion (LFI) vulnerability in LightBlog 9.6 by manipulating the 'username' parameter to traverse directories and read arbitrary files (e.g., /etc/passwd). The null byte (%00) is used to terminate the string and bypass file extension checks.