CVE-2008-5291

fuzzylime_cms 3.03 - Remote File Inclusion via Track.php p Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-5291. PoCs published by Alfons Luja.

AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in FuzzyLime 3.03 via the 'track.php' script. The 'p' parameter is not properly sanitized, allowing an attacker to include arbitrary local files when POST data is provided.

Description

Directory traversal vulnerability in code/track.php in FuzzyLime 3.03 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the p parameter, a different vector than CVE-2007-4805 and CVE-2008-3165.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Alfons Luja · textwebappsphp

https://www.exploit-db.com/exploits/7231

View Code ZIP pw:eip

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in FuzzyLime 3.03 via the 'track.php' script. The 'p' parameter is not properly sanitized, allowing an attacker to include arbitrary local files when POST data is provided.

Classification

Working Poc 90%

Attack Type

Lfi

Complexity

Trivial

Reliability

Reliable

Target: FuzzyLime 3.03

No auth needed

Prerequisites: Access to the target application · Ability to send crafted HTTP requests

MITRE ATT&CK