CVE-2008-5922

CFAGCMS 1 - Remote Code Execution via Main or Right Parameter Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-5922. PoCs published by BeyazKurt.

AI-analyzed exploit summary This exploit demonstrates a local file inclusion vulnerability in CFAGCMS due to unsanitized user input in the 'main' and 'right' parameters in themes/default/index.php. An attacker can include arbitrary files, potentially leading to remote code execution if combined with file upload or log poisoning.

Description

Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Cant Find A Gaming CMS (CFAGCMS) 1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) main and (2) right parameters.

Exploits (1)

exploitdb WORKING POC VERIFIED

by BeyazKurt · textwebappsphp

https://www.exploit-db.com/exploits/7459

View Code ZIP pw:eip

This exploit demonstrates a local file inclusion vulnerability in CFAGCMS due to unsanitized user input in the 'main' and 'right' parameters in themes/default/index.php. An attacker can include arbitrary files, potentially leading to remote code execution if combined with file upload or log poisoning.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: CFAGCMS (version not specified)

No auth needed

Prerequisites: Access to the vulnerable endpoint · Ability to upload a shell or poison logs for RCE

MITRE ATT&CK