CVE-2008-2876

munky 0.0.1 - Remote File Inclusion via Zone Parameter Path Traversal

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-2876. PoCs published by StAkeR.

AI-analyzed exploit summary This is a writeup describing a Local File Inclusion (LFI) vulnerability in mUnky 0.0.1. The exploit demonstrates how to read arbitrary files (e.g., /etc/passwd) via a null-byte terminated path traversal in the 'zone' parameter.

Description

Directory traversal vulnerability in index.php in mUnky 0.0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the zone parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by StAkeR · textwebappsphp

https://www.exploit-db.com/exploits/5933

View Code ZIP pw:eip

This is a writeup describing a Local File Inclusion (LFI) vulnerability in mUnky 0.0.1. The exploit demonstrates how to read arbitrary files (e.g., /etc/passwd) via a null-byte terminated path traversal in the 'zone' parameter.

Classification

Writeup 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: mUnky 0.0.1

No auth needed

Prerequisites: access to the vulnerable web application

MITRE ATT&CK