CVE-2008-7123

This exploit leverages a NULL byte injection vulnerability in zKup CMS v2.0 to v2.3 to bypass input validation and inject malicious PHP code into the configuration file, resulting in arbitrary file upload functionality. The exploit requires magic_quotes_gpc to be off and targets the admin configuration modifier script.