CVE-2008-4426
Phlatline Personal Information Manager 1.0 - Cross-Site Scripting via events.php date parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2008-4426. PoCs published by BeyazKurt.
AI-analyzed exploit summary The exploit demonstrates a file deletion vulnerability in Ppim v1.0 via the 'upload.php' script and an XSS vulnerability in 'events.php'. It provides clear examples of malicious URLs to trigger these vulnerabilities.
Description
Cross-site scripting (XSS) vulnerability in events.php in Phlatline's Personal Information Manager (pPIM) 1.0 allows remote attackers to inject arbitrary web script or HTML via the date parameter in a new action.
Exploits (3)
The exploit demonstrates a file deletion vulnerability in Ppim v1.0 via the 'upload.php' script and an XSS vulnerability in 'events.php'. It provides clear examples of malicious URLs to trigger these vulnerabilities.
The exploit demonstrates two vulnerabilities in Ppim v1.0: an unauthenticated password change and an arbitrary file upload leading to remote code execution. The PoC provides direct URLs and steps to exploit these flaws.
This is a detailed technical analysis of multiple vulnerabilities in pPIM 1.0, including authentication bypass, arbitrary file upload, command execution, and credential exposure. It provides proof-of-concept Perl scripts for exploitation but focuses on explaining the root causes and attack vectors.