CVE-2008-5677
Kwalbum < 2.0.2 - Authenticated Arbitrary File Upload and Remote Code Execution via Executable File Extension
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-5677. PoCs published by CWH Underground.
AI-analyzed exploit summary This is a writeup describing an arbitrary file upload vulnerability in Kwalbum <= 2.0.2. It explains how an attacker with upload permissions can upload a PHP shell and execute it via a predictable path.
Description
Unrestricted file upload vulnerability in Kwalbum 2.0.4, 2.0.2, and earlier, when PICS_PATH is located in the web root, allows remote authenticated users with upload capability to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under items/, related to the ReplaceBadFilenameChars function in include/ItemAdder.php. NOTE: some of these details are obtained from third party information.
Exploits (1)
This is a writeup describing an arbitrary file upload vulnerability in Kwalbum <= 2.0.2. It explains how an attacker with upload permissions can upload a PHP shell and execute it via a predictable path.