CVE-2008-4428
Phlatline Personal Information Manager < 1.0 - Unauthenticated Arbitrary File Upload via upload.php
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2008-4428. PoCs published by Stack.
AI-analyzed exploit summary The exploit demonstrates two vulnerabilities in Ppim v1.0: an unauthenticated password change and an arbitrary file upload leading to remote code execution. The PoC provides direct URLs and steps to exploit these flaws.
Description
Unrestricted file upload vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier allows remote attackers to execute arbitrary code by uploading a .php file, then accessing it via a direct request to the file in the top-level directory.
Exploits (3)
The exploit demonstrates two vulnerabilities in Ppim v1.0: an unauthenticated password change and an arbitrary file upload leading to remote code execution. The PoC provides direct URLs and steps to exploit these flaws.
This is a detailed technical analysis of multiple vulnerabilities in pPIM 1.0, including authentication bypass, arbitrary file upload, command execution, and credential exposure. It provides proof-of-concept Perl scripts for exploitation but focuses on explaining the root causes and attack vectors.
The exploit demonstrates a file deletion vulnerability in `upload.php` and an XSS vulnerability in `events.php` for Ppim v1.0. It provides clear examples of malicious URLs to trigger these vulnerabilities.