CVE-2010-2099
EXPLOITEDe107 < 0.7.20 - Remote PHP Code Execution via BBCode Tag in Contact Form
Title source: llmExploitation Summary
CVE-2010-2099 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including McFly.
AI-analyzed exploit summary This Perl script exploits a PHP code injection vulnerability in e107's contact form by injecting a PHP payload via the 'author_name' parameter. The payload executes the 'id' command, demonstrating remote code execution (RCE).
Description
bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attackers to execute arbitrary PHP code, as demonstrated using the toEmail method in contact.php, related to invocations of the toHTML method.
Exploits (1)
This Perl script exploits a PHP code injection vulnerability in e107's contact form by injecting a PHP payload via the 'author_name' parameter. The payload executes the 'id' command, demonstrating remote code execution (RCE).