CVE-2008-6592
LightNEasy - Path Traversal and Arbitrary File Access via thumbsup.php Image Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-6592. PoCs published by girex.
AI-analyzed exploit summary This exploit demonstrates multiple vulnerabilities in LightNEasy CMS <= 1.2.2, including remote file disclosure, arbitrary file copy/rename, remote command execution via PHP injection, and SQL injection. The PoC provides clear steps and endpoints for exploitation.
Description
thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified cache_dir parameter containing a %00 (encoded null byte).
Exploits (1)
This exploit demonstrates multiple vulnerabilities in LightNEasy CMS <= 1.2.2, including remote file disclosure, arbitrary file copy/rename, remote command execution via PHP injection, and SQL injection. The PoC provides clear steps and endpoints for exploitation.