CVE-2009-4819
PHPhotoalbum - Unauthenticated Arbitrary File Upload via Double Extension Bypass
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-4819. PoCs published by wlhaan hacker.
AI-analyzed exploit summary This is a writeup describing a file upload vulnerability in PHPhotoalbum, allowing attackers to bypass file extension restrictions by appending '.pgif' or '.pjpeg' to PHP files. The exploit involves uploading a malicious PHP file and accessing it to achieve remote code execution.
Description
Multiple unrestricted file upload vulnerabilities in upload.php in PHPhotoalbum allow remote attackers to execute arbitrary code by uploading a file with a (1) .php.pgif or (2) .php.pjpeg double extension, then accessing it via a direct request to the file in albums/userpics/.
Exploits (1)
This is a writeup describing a file upload vulnerability in PHPhotoalbum, allowing attackers to bypass file extension restrictions by appending '.pgif' or '.pjpeg' to PHP files. The exploit involves uploading a malicious PHP file and accessing it to achieve remote code execution.