CVE-2008-7124

This exploit leverages a NULL byte injection vulnerability in zKup CMS v2.0 to v2.3 to bypass input validation and inject malicious PHP code into the configuration file, resulting in arbitrary file upload functionality. The exploit requires magic_quotes_gpc to be off and targets the admin configuration modifier script.

This exploit adds an admin user to zKup CMS versions 2.0 to 2.3 by sending a crafted POST request to the admin configuration page. It bypasses authentication by directly submitting user credentials and privilege level to the vulnerable endpoint.