CVE-2008-4427
Phlatline Personal Information Manager < 1.0 - Unauthenticated Arbitrary Password Change
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2008-4427. PoCs published by Stack.
AI-analyzed exploit summary The exploit demonstrates two vulnerabilities in Ppim v1.0: an unauthenticated password change and an arbitrary file upload leading to remote code execution. The PoC provides direct URLs and steps to exploit these flaws.
Description
changepassword.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier does not require administrative authentication, which allows remote attackers to change arbitrary passwords.
Exploits (3)
The exploit demonstrates two vulnerabilities in Ppim v1.0: an unauthenticated password change and an arbitrary file upload leading to remote code execution. The PoC provides direct URLs and steps to exploit these flaws.
This is a detailed technical analysis of multiple vulnerabilities in pPIM 1.0, including authentication bypass, arbitrary file upload, command execution, and credential exposure. It provides proof-of-concept Perl scripts and explains the root causes of each flaw.
This exploit demonstrates two vulnerabilities in Ppim v1.0: an arbitrary file deletion vulnerability via the 'upload.php' script and a reflected XSS vulnerability in 'events.php'. The file deletion exploit allows an attacker to delete arbitrary files by manipulating the 'file' parameter, while the XSS exploit injects malicious scripts via the 'date' parameter.