CVE-2008-4528
Phlatline Personal Information Manager 1.01 - Path Traversal via Notes.php ID Parameter
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2008-4528. PoCs published by Justin Keane, JosS, Stack.
AI-analyzed exploit summary This is a detailed writeup describing multiple vulnerabilities in pPIM 1.0, including authentication bypass, arbitrary file upload, command execution, and credential exposure. It includes Perl scripts for exploiting file upload and email relay flaws.
Description
Directory traversal vulnerability in notes.php in Phlatline's Personal Information Manager (pPIM) 1.01 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter in an edit action.
Exploits (4)
This is a detailed writeup describing multiple vulnerabilities in pPIM 1.0, including authentication bypass, arbitrary file upload, command execution, and credential exposure. It includes Perl scripts for exploiting file upload and email relay flaws.
This exploit demonstrates a Local File Inclusion (LFI) vulnerability in pPIM 1.01 due to improper handling of the 'id' parameter in notes.php. The vulnerability allows an attacker to read arbitrary files on the server by manipulating the 'id' parameter.
The exploit demonstrates two vulnerabilities in Ppim v1.0: an unauthenticated password change and an arbitrary file upload leading to remote code execution. The PoC provides direct URLs and steps to exploit these flaws.
The exploit demonstrates a file deletion vulnerability in Ppim v1.0 via the 'upload.php' script and an XSS vulnerability in 'events.php'. It provides clear examples of malicious URLs to trigger these vulnerabilities.