CVE-2009-3167

This script exploits multiple vulnerabilities in Gazelle CMS 1.0, including RCE via file upload, LFI, and XSS. It uploads a malicious PHP file via a template customization feature and provides a shell interface for command execution.

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Gazelle CMS by manipulating the 'template' parameter to traverse directories and access sensitive files like '/etc/passwd'. The null byte (%00) is used to terminate the string and bypass file extension checks.