CVE-2009-2132
4images < 1.7.7 - Unauthenticated Path Traversal via Global.php l Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-2132. PoCs published by Qabandi.
AI-analyzed exploit summary This exploit demonstrates a filter bypass HTML injection/XSS vulnerability in 4images <= 1.7.7. It leverages improper sanitization of the user_homepage field to inject malicious JavaScript, which executes when a user posts a comment on an image.
Description
Directory traversal vulnerability in global.php in 4images before 1.7.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter.
Exploits (1)
This exploit demonstrates a filter bypass HTML injection/XSS vulnerability in 4images <= 1.7.7. It leverages improper sanitization of the user_homepage field to inject malicious JavaScript, which executes when a user posts a comment on an image.