CVE-2008-4509
FOSS Gallery 1.0 beta - Unauthenticated Arbitrary File Upload via processFiles.php
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2008-4509. PoCs published by Pepelux, JosS.
AI-analyzed exploit summary This is a writeup describing an arbitrary file upload vulnerability in FOSS Gallery Public Version <= 1.0. The vulnerability allows attackers to upload PHP files due to lack of proper file format validation in processFiles.php.
Description
Unrestricted file upload vulnerability in processFiles.php in FOSS Gallery Admin and FOSS Gallery Public 1.0 beta allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the root directory.
Exploits (3)
This is a writeup describing an arbitrary file upload vulnerability in FOSS Gallery Public Version <= 1.0. The vulnerability allows attackers to upload PHP files due to lack of proper file format validation in processFiles.php.
This exploit targets FOSS Gallery Public <= 1.0, allowing arbitrary file upload via a vulnerable endpoint (`processFiles.php`). It uploads a PHP shell (default: `c99.php`) and executes commands to retrieve system information.
This exploit leverages an arbitrary file upload vulnerability in FOSS Gallery Admin Version <= 1.0 by bypassing authentication checks in the upload process. It directly POSTs to processFiles.php, allowing an attacker to upload any file, including a malicious shell.