CVE-2008-6793
DFLabs PTK 0.1, 0.2, and 1.0 - Remote Command Execution via Filename Shell Metacharacters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-6793. PoCs published by ikki.
AI-analyzed exploit summary This exploit leverages a local command execution vulnerability in DFLabs PTK 1.0 by injecting malicious payloads into filenames, which are then executed via unfiltered shell_exec calls in PHP scripts. The PoC demonstrates how an attacker can open a remote shell and compromise forensic evidence.
Description
The get_file_type function in lib/file_content.php in DFLabs PTK 0.1, 0.2, and 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters after an arg1= sequence in a filename within a forensic image.
Exploits (1)
This exploit leverages a local command execution vulnerability in DFLabs PTK 1.0 by injecting malicious payloads into filenames, which are then executed via unfiltered shell_exec calls in PHP scripts. The PoC demonstrates how an attacker can open a remote shell and compromise forensic evidence.