CVE-2008-6420
Social Site Generator 2.0 - Unauthenticated Arbitrary File Read via File Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-6420. PoCs published by Stack.
AI-analyzed exploit summary This exploit demonstrates a remote file disclosure vulnerability in Social Site Generator via the 'filedload.php' and 'download.php' scripts. The PoC provides direct URLs to retrieve sensitive files by manipulating the 'file' parameter.
Description
Social Site Generator (SSG) 2.0 allows remote attackers to read arbitrary files via the file parameter to (1) filedload.php, (2) webadmin/download.php, and (3) webadmin/download_file.php.
Exploits (2)
This exploit demonstrates a remote file disclosure vulnerability in Social Site Generator via the 'filedload.php' and 'download.php' scripts. The PoC provides direct URLs to retrieve sensitive files by manipulating the 'file' parameter.
The exploit demonstrates SQL injection vulnerabilities in Social Site Generator by providing crafted URLs that extract admin credentials (admin_id and password) from the web_admin table. The attack leverages UNION-based SQLi in multiple endpoints.