CVE-2008-5771

PHP Weather 2.2.2 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-5771. PoCs published by ahmadbady.

AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) and Cross-Site Scripting (XSS) vulnerability in phpweather-2.2.2. The LFI is achieved by manipulating the 'language' parameter with a null byte, while the XSS is triggered via the 'make_config.php' script.

Description

Directory traversal vulnerability in test.php in PHP Weather 2.2.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the language parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by ahmadbady · textwebappsphp
https://www.exploit-db.com/exploits/7451

This exploit demonstrates a Local File Inclusion (LFI) and Cross-Site Scripting (XSS) vulnerability in phpweather-2.2.2. The LFI is achieved by manipulating the 'language' parameter with a null byte, while the XSS is triggered via the 'make_config.php' script.

Classification
Working Poc 90%
Attack Type
Lfi | Xss
Complexity
Trivial
Reliability
Reliable
Target: phpweather-2.2.2
No auth needed
Prerequisites: Access to the vulnerable web application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/4826
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/32820
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33098
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/7451

Scores

EPSS 0.0230
EPSS Percentile 81.0%

Details

CWE
CWE-22
Status published
Products (1)
phpweather/phpweather 2.2.2
Published Dec 30, 2008
Tracked Since Feb 18, 2026