CVE-2008-6177
LightBlog 9.8 - Path Traversal and Arbitrary File Execution via Username Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-6177. PoCs published by JosS.
AI-analyzed exploit summary This exploit demonstrates multiple local file inclusion vulnerabilities in LightBlog 9.8 via GET, POST, and COOKIE parameters. The PoC shows how an attacker can read arbitrary files by manipulating input parameters with directory traversal sequences and null bytes.
Description
Multiple directory traversal vulnerabilities in LightBlog 9.8, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) username parameter to view_member.php, (2) username_post parameter to login.php, and the (3) Lightblog_username cookie parameter to check_user.php.
Exploits (1)
This exploit demonstrates multiple local file inclusion vulnerabilities in LightBlog 9.8 via GET, POST, and COOKIE parameters. The PoC shows how an attacker can read arbitrary files by manipulating input parameters with directory traversal sequences and null bytes.