CVE-2008-4740
TinyCMS 1.1.2 - Remote File Inclusion via ZZ_Templater config[template] Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-4740. PoCs published by cOndemned.
AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in tinyCMS 1.1.2 via the 'config[template]' parameter in templater.php. The PoC shows how to read arbitrary files by traversing directories and appending a null byte.
Description
Directory traversal vulnerability in templater.php in the ZZ_Templater module in TinyCMS 1.1.2, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the config[template] parameter.
Exploits (1)
This exploit demonstrates a Local File Inclusion (LFI) vulnerability in tinyCMS 1.1.2 via the 'config[template]' parameter in templater.php. The PoC shows how to read arbitrary files by traversing directories and appending a null byte.