CVE-2008-4767
PHP-Nuke DownloadsPlus Module - Unrestricted File Upload and Remote Code Execution via .htm .html or .txt Extensions
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-4767. PoCs published by ZoRLu.
AI-analyzed exploit summary The exploit describes a vulnerability in the DownloadsPlus module for PHP-Nuke that allows remote attackers to upload and execute arbitrary code due to insufficient input sanitization. Attackers can upload files with '.htm', '.html', or '.txt' extensions, potentially leading to remote code execution with webserver privileges.
Description
Unrestricted file upload vulnerability in the DownloadsPlus module in PHP-Nuke allows remote attackers to execute arbitrary code by uploading a file with (1) .htm, (2) .html, or (3) .txt extensions, then accessing it via a direct request to the file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: it is unclear how allowing the upload of .html or .txt files supports arbitrary code execution; this might be legitimate functionality.
Exploits (1)
The exploit describes a vulnerability in the DownloadsPlus module for PHP-Nuke that allows remote attackers to upload and execute arbitrary code due to insufficient input sanitization. Attackers can upload files with '.htm', '.html', or '.txt' extensions, potentially leading to remote code execution with webserver privileges.