CVE-2008-4454
MySQL Quick Admin 1.5.5 - Path Traversal via Lang Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-4454. PoCs published by Vinod Sharma.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in MySQL Quick Admin 1.5.5 via the 'lang' parameter in actions.php, allowing remote attackers to read arbitrary files. The vulnerability arises from unsanitized user input being passed to an include() function.
Description
Directory traversal vulnerability in EKINdesigns MySQL Quick Admin 1.5.5 allows remote attackers to read and execute arbitrary files via a .. (dot dot) in the lang parameter to actions.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploits (2)
This exploit demonstrates a directory traversal vulnerability in MySQL Quick Admin 1.5.5 via the 'lang' parameter in actions.php, allowing remote attackers to read arbitrary files. The vulnerability arises from unsanitized user input being passed to an include() function.
The exploit demonstrates a Local File Inclusion (LFI) vulnerability in MySQL Quick Admin <= 1.5.5 by manipulating the 'language' cookie to include arbitrary files. The vulnerability arises from improper input validation in the 'required.php' file, allowing path traversal attacks.