CVE-2008-4873

EXPLOITED

Sepal SPBOARD 4.5 - Remote Command Execution via board.cgi file Parameter

Title source: llm

Exploitation Summary

CVE-2008-4873 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including GoLd_M.

AI-analyzed exploit summary This exploit demonstrates a remote command execution vulnerability in Sepal's SPBOARD v4.5 via the 'file' parameter in board.cgi. The PoC shows how arbitrary commands can be injected and executed through the 'down_file' action.

Description

board.cgi in Sepal SPBOARD 4.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter during a down_file action.

Exploits (1)

exploitdb WORKING POC VERIFIED

by GoLd_M · textwebappscgi

https://www.exploit-db.com/exploits/6864

View Code ZIP pw:eip

This exploit demonstrates a remote command execution vulnerability in Sepal's SPBOARD v4.5 via the 'file' parameter in board.cgi. The PoC shows how arbitrary commands can be injected and executed through the 'down_file' action.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Sepal's SPBOARD v4.5

No auth needed

Prerequisites: Access to the vulnerable CGI script · Network connectivity to the target

MITRE ATT&CK