CVE-2008-6934
Sanusart Free Simple Guestbook PHP Script - Remote Code Execution via Message Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-6934. PoCs published by GoLd_M.
AI-analyzed exploit summary This exploit demonstrates a Remote Code Execution (RCE) vulnerability in FREEsimplePHPguestbook by injecting PHP code into the 'Message' field, which is then executed via a GET parameter. The PoC leverages the `passthru` function to execute arbitrary commands.
Description
Static code injection vulnerability in Sanus|artificium (aka Sanusart) Free simple guestbook PHP script, when downloaded before 20081111, allows remote attackers to inject arbitrary PHP code into messages.txt via the message parameter to act.php, which is executed when guestbook/guestbook.php is accessed. NOTE: some of these details are obtained from third party information.
Exploits (1)
This exploit demonstrates a Remote Code Execution (RCE) vulnerability in FREEsimplePHPguestbook by injecting PHP code into the 'Message' field, which is then executed via a GET parameter. The PoC leverages the `passthru` function to execute arbitrary commands.