CVE-2008-7209
OneCMS < 2.4 - Unauthenticated Arbitrary File Upload and Remote Code Execution via a_upload.php
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-7209. PoCs published by BugReport.IR.
AI-analyzed exploit summary This is a technical writeup detailing SQL injection and arbitrary file upload vulnerabilities in OneCMS 2.4. It includes code snippets, proof-of-concept examples, and exploitation steps, demonstrating a deep understanding of the vulnerabilities.
Description
Unrestricted file upload vulnerability in the add2 action in a_upload.php in OneCMS 2.4, and possibly earlier, allows remote attackers to execute arbitrary code by uploading a file with an executable extension and using a safe content type such as image/gif, then accessing it via a direct request to the file in an unspecified directory.
Exploits (1)
This is a technical writeup detailing SQL injection and arbitrary file upload vulnerabilities in OneCMS 2.4. It includes code snippets, proof-of-concept examples, and exploitation steps, demonstrating a deep understanding of the vulnerabilities.