CVE-2008-7123
zkup CMS 2.0-2.3 - Remote Code Execution via Null Byte Injection in Login Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-7123. PoCs published by Charles Fol.
AI-analyzed exploit summary This exploit leverages a NULL byte injection vulnerability in zKup CMS v2.0 to v2.3 to bypass input validation and inject malicious PHP code into the configuration file, resulting in arbitrary file upload functionality. The exploit requires magic_quotes_gpc to be off and targets the admin configuration modifier script.
Description
Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte (%00) in the login parameter in an ajout action, which bypasses the regular expression check.
Exploits (1)
This exploit leverages a NULL byte injection vulnerability in zKup CMS v2.0 to v2.3 to bypass input validation and inject malicious PHP code into the configuration file, resulting in arbitrary file upload functionality. The exploit requires magic_quotes_gpc to be off and targets the admin configuration modifier script.