CVE-2008-2648

meBiblio 0.4.7 - Unauthenticated Arbitrary File Upload and Remote Code Execution via PHP File Upload

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-2648. PoCs published by CWH Underground.

AI-analyzed exploit summary The exploit demonstrates SQL injection, arbitrary file upload, and XSS vulnerabilities in meBiblio 0.4.7. It includes specific URLs and parameters for exploitation, confirming functional PoC details.

Description

Unrestricted file upload vulnerability in upload/uploader.html in meBiblio 0.4.7 allows remote attackers to execute arbitrary code by uploading a .php file, then accessing it via a direct request to the files/ directory.

Exploits (1)

exploitdb WORKING POC VERIFIED
by CWH Underground · textwebappsphp
https://www.exploit-db.com/exploits/5716

The exploit demonstrates SQL injection, arbitrary file upload, and XSS vulnerabilities in meBiblio 0.4.7. It includes specific URLs and parameters for exploitation, confirming functional PoC details.

Classification
Working Poc 90%
Attack Type
Sqli | Xss | Other
Complexity
Trivial
Reliability
Reliable
Target: meBiblio 0.4.7
No auth needed
Prerequisites: Access to the target web application · File upload directory must exist for arbitrary file upload
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/5716
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/42761
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/29465

Scores

EPSS 0.0333
EPSS Percentile 87.0%

Details

CWE
CWE-20
Status published
Products (1)
mebiblio/mebiblio 0.4.7
Published Jun 10, 2008
Tracked Since Feb 18, 2026