Exploitation Summary
EIP tracks 1 public exploit for CVE-2008-3592. PoCs published by Raz0r.
AI-analyzed exploit summary This exploit leverages a SQL injection vulnerability in Symphony CMS <= 1.7.01 to bypass admin authentication and upload a malicious PHP file, enabling remote command execution. The PoC demonstrates a full attack chain from auth bypass to RCE via file upload.
Description
Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to a directory specified in the destination parameter, then accessing the uploaded file via a direct request, as demonstrated using workspace/masters/.
Exploits (1)
This exploit leverages a SQL injection vulnerability in Symphony CMS <= 1.7.01 to bypass admin authentication and upload a malicious PHP file, enabling remote command execution. The PoC demonstrates a full attack chain from auth bypass to RCE via file upload.