CVE-2008-6833
fuzzylime_cms - Path Traversal via commsrss.php files Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-6833. PoCs published by Charles Fol.
AI-analyzed exploit summary This exploit leverages a file inclusion vulnerability in Fuzzylime CMS 3.01 via the `commsrss.php` script, which uses `extract()` to simulate `register_globals=On`. It then writes malicious PHP code to a counter file, achieving remote code execution without requiring specific PHP configurations.
Description
Directory traversal vulnerability in commsrss.php in fuzzylime (cms) before 3.01b allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a files array element for a blogs action, as demonstrated by the files[0] parameter.
Exploits (1)
This exploit leverages a file inclusion vulnerability in Fuzzylime CMS 3.01 via the `commsrss.php` script, which uses `extract()` to simulate `register_globals=On`. It then writes malicious PHP code to a counter file, achieving remote code execution without requiring specific PHP configurations.