Exploitation Summary
EIP tracks 1 public exploit for CVE-2008-3128. PoCs published by Nine:Situations:Group.
AI-analyzed exploit summary This exploit leverages a directory traversal vulnerability in Pivot 1.40.5's load_template() function to disclose admin credentials stored in pv_cfg_settings.php. The 't' parameter is passed unsanitized to the file() function, allowing arbitrary file reads.
Description
Directory traversal vulnerability in search.php in Pivot 1.40.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the t parameter.
Exploits (1)
This exploit leverages a directory traversal vulnerability in Pivot 1.40.5's load_template() function to disclose admin credentials stored in pv_cfg_settings.php. The 't' parameter is passed unsanitized to the file() function, allowing arbitrary file reads.