CVE-2009-1780
Frax.dk Php Recommend <= 1.3 - Unauthenticated Privilege Escalation via Password Change
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-1780. PoCs published by scriptjunkie.
AI-analyzed exploit summary The exploit demonstrates an authentication bypass, remote file inclusion (RFI), and code injection in Php Recommend <=1.3 due to insufficient input validation and improper file handling in admin.php. The vulnerable code allows arbitrary file writes and remote code execution via crafted HTTP requests.
Description
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters.
Exploits (1)
The exploit demonstrates an authentication bypass, remote file inclusion (RFI), and code injection in Php Recommend <=1.3 due to insufficient input validation and improper file handling in admin.php. The vulnerable code allows arbitrary file writes and remote code execution via crafted HTTP requests.