CVE-2008-6772
YourPlace <= 1.0.2 - Unauthenticated Account Takeover via Username Collision
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-6772. PoCs published by Osirys.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in YourPlace 0.5 (beta 1), including database disclosure, arbitrary data saving leading to RCE, arbitrary file upload, PHPInfo disclosure, and user account manipulation. The Perl script provided automates the RCE exploit by injecting malicious PHP code into a writable file.
Description
login/register_form.php in YourPlace 1.0.2 and earlier does not check that a username already exists when a new account is created, which allows remote attackers to bypass intended access restrictions by registering a new account with the username of a target user.
Exploits (1)
The exploit demonstrates multiple vulnerabilities in YourPlace 0.5 (beta 1), including database disclosure, arbitrary data saving leading to RCE, arbitrary file upload, PHPInfo disclosure, and user account manipulation. The Perl script provided automates the RCE exploit by injecting malicious PHP code into a writable file.