CVE-2008-6785
Mini File Host 1.5 - Unauthenticated Arbitrary File Upload and Remote Code Execution via Executable File Extension
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-6785. PoCs published by MR.Z, Pouya_Server.
AI-analyzed exploit summary This exploit demonstrates a remote file upload vulnerability in Mini File Host v1.5, allowing an attacker to upload a PHP shell if the 'storage' directory is unprotected. The PoC provides step-by-step instructions to exploit the vulnerability and achieve remote code execution.
Description
Unrestricted file upload vulnerability in Mini File Host 1.5 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as demonstrated by creating a name.php file.
Exploits (2)
This exploit demonstrates a remote file upload vulnerability in Mini File Host v1.5, allowing an attacker to upload a PHP shell if the 'storage' directory is unprotected. The PoC provides step-by-step instructions to exploit the vulnerability and achieve remote code execution.
This exploit demonstrates a file upload bypass vulnerability in Mini File Host by crafting a malicious file with a GIF header followed by PHP shellcode. The server incorrectly validates the file type based on the MIME header, allowing arbitrary PHP code execution.