CVE-2008-1866

PixelMotion - RCE

Title source: llm

Description

admin/modif_config.php in Blog Pixel Motion (aka PixelMotion) does not require admin authentication, which allows remote authenticated users to upload arbitrary PHP scripts in a ZIP archive, which is written to templateZip/ and then automatically extracted under templates/ for execution via a direct request.

Exploits (2)

exploitdb WRITEUP VERIFIED

by JIKO · textwebappsphp

https://www.exploit-db.com/exploits/5381

View Code ZIP pw:eip

exploitdb WORKING POC

webappsphp

https://www.exploit-db.com/exploits/5380

View Code ZIP pw:eip

References (4)

[Exploit] http://www.securityfocus.com/bid/28646

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/5381

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/41670

[Third Party Advisory] http://www.vupen.com/english/advisories/2008/1121/references

Scores

EPSS 0.1511

EPSS Percentile 94.6%

Details

CWE

CWE-94

Status published

Products (1)

pixel_motion/pixel_motion_blog

Published Apr 17, 2008

Tracked Since Feb 18, 2026