CVE-2008-6978
Full Revolution aspWebAlbum 3.2 - Unrestricted File Upload and Remote Code Execution via pics/ Directory
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-6978. PoCs published by e.wiZz!, Alemin_Krali.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in aspWebAlbum 3.2, including arbitrary file upload, admin bypass via SQL injection, and XSS. It provides clear URLs and parameters for exploitation.
Description
Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in pics/, related to the uploadmedia action in album.asp.
Exploits (2)
The exploit demonstrates multiple vulnerabilities in aspWebAlbum 3.2, including arbitrary file upload, admin bypass via SQL injection, and XSS. It provides clear URLs and parameters for exploitation.
This is a writeup detailing multiple vulnerabilities in aspWebAlbum 3.2, including arbitrary file upload, admin bypass, and XSS. It provides URLs and parameters for exploitation but does not include functional exploit code.