CVE-2008-6834
fuzzylime (cms) 3.01 and 3.01a - Path Traversal via commupdate.php s Parameter or newsheads.php heads Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-6834. PoCs published by Cod3rZ.
AI-analyzed exploit summary This exploit targets Fuzzylime CMS 3.01 via Local File Inclusion (LFI) and Remote Code Execution (RCE) by injecting PHP code into logs and accessing it through vulnerable parameters. It uses LWP::UserAgent to send HTTP requests and verify successful exploitation.
Description
Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.01 and 3.01a allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the s parameter to code/commupdate.php in a count action or (2) the heads parameter to code/newsheads.php. NOTE: the blog.php vector is already covered by CVE-2008-3164.
Exploits (1)
This exploit targets Fuzzylime CMS 3.01 via Local File Inclusion (LFI) and Remote Code Execution (RCE) by injecting PHP code into logs and accessing it through vulnerable parameters. It uses LWP::UserAgent to send HTTP requests and verify successful exploitation.