CVE-2009-0515

yanocc < 0.1.0 - Remote File Inclusion via Lang Parameter Path Traversal

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-0515. PoCs published by Kacper.

AI-analyzed exploit summary The exploit describes a Local File Inclusion (LFI) vulnerability in YANOCC 0.1.0 due to improper handling of the 'lang' parameter in check_lang.php. The vulnerability allows an attacker to include arbitrary local files by manipulating the parameter with directory traversal sequences.

Description

Directory traversal vulnerability in check_lang.php in Yet Another NOCC (YANOCC) 0.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Kacper · textwebappsphp

https://www.exploit-db.com/exploits/8020

View Code ZIP pw:eip

The exploit describes a Local File Inclusion (LFI) vulnerability in YANOCC 0.1.0 due to improper handling of the 'lang' parameter in check_lang.php. The vulnerability allows an attacker to include arbitrary local files by manipulating the parameter with directory traversal sequences.

Classification

Writeup 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: YANOCC 0.1.0

No auth needed

Prerequisites: Access to the vulnerable check_lang.php endpoint

MITRE ATT&CK