CVE-2008-4346
TalkBack 2.3.6 and 2.3.6.4 - Path Traversal via Language Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-4346. PoCs published by SirGod.
AI-analyzed exploit summary The exploit demonstrates local file inclusion (LFI) and PHP info disclosure vulnerabilities in Talkback 2.3.6. It provides functional PoC URLs to read arbitrary files via path traversal and null byte injection, as well as a direct endpoint for PHP configuration exposure.
Description
Directory traversal vulnerability in TalkBack 2.3.6 and 2.3.6.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter to comments.php, a different vector than CVE-2008-3371.
Exploits (1)
The exploit demonstrates local file inclusion (LFI) and PHP info disclosure vulnerabilities in Talkback 2.3.6. It provides functional PoC URLs to read arbitrary files via path traversal and null byte injection, as well as a direct endpoint for PHP configuration exposure.