CVE-2008-7064
Quicksilver Forums <= 1.4.2 - Remote Code Execution via Lang Parameter Backslash Bypass
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-7064. PoCs published by girex.
AI-analyzed exploit summary This exploit targets a Local File Inclusion (LFI) vulnerability in Quicksilver Forums <= 1.4.2, leveraging a malicious avatar upload to achieve Remote Command Execution (RCE) on Windows servers. The exploit bypasses PHP's magic_quotes_gpc and file path filters by using backslashes and null bytes.
Description
Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as used in QSF Portal before 1.4.5, when running on Windows, allows remote attackers to include and execute arbitrary local files via a "\" (backslash) in the lang parameter to index.php, which bypasses a protection mechanism that only checks for "/" (forward slash), as demonstrated by uploading and including PHP code in an avatar file.
Exploits (1)
This exploit targets a Local File Inclusion (LFI) vulnerability in Quicksilver Forums <= 1.4.2, leveraging a malicious avatar upload to achieve Remote Command Execution (RCE) on Windows servers. The exploit bypasses PHP's magic_quotes_gpc and file path filters by using backslashes and null bytes.