CVE-2008-2638
1-script 1-book < 1.0.1 - Remote Code Execution via Guestbook Message Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-2638. PoCs published by JIKO.
AI-analyzed exploit summary This exploit leverages a PHP deserialization vulnerability in 1Book Guestbook Script to achieve remote code execution by injecting malicious serialized data into the guestbook entries, allowing an attacker to include arbitrary PHP files via a crafted request.
Description
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitrary PHP code via the message parameter in an HTML webform, which is written to data.php.
Exploits (1)
This exploit leverages a PHP deserialization vulnerability in 1Book Guestbook Script to achieve remote code execution by injecting malicious serialized data into the guestbook entries, allowing an attacker to include arbitrary PHP files via a crafted request.