CVE-2008-4557
CuteNews 1.1.1 - Remote Code Execution via Text Parameter in Highlight Plugin
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-4557. PoCs published by Eugene Minaev.
AI-analyzed exploit summary This exploit leverages a PHP preg_replace vulnerability with the 'e' modifier in CuteNews, allowing remote code execution via crafted input. The PoC demonstrates command injection by embedding malicious PHP code in the 'text' parameter.
Description
plugins/wacko/highlight/html.php in Strawberry in CuteNews.ru 1.1.1 (aka Strawberry) allows remote attackers to execute arbitrary PHP code via the text parameter, which is inserted into an executable regular expression.
Exploits (1)
This exploit leverages a PHP preg_replace vulnerability with the 'e' modifier in CuteNews, allowing remote code execution via crafted input. The PoC demonstrates command injection by embedding malicious PHP code in the 'text' parameter.