Exploitation Summary
EIP tracks 1 public exploit for CVE-2010-3480. PoCs published by Abysssec.
AI-analyzed exploit summary The exploit demonstrates an authentication bypass via SQL injection in the login mechanism and a local file inclusion vulnerability in PHP MicroCMS 1.0.1. The SQL injection allows bypassing authentication by injecting malicious input into the username and password fields, while the LFI allows reading arbitrary files by manipulating the 'page' parameter.
Description
Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
Exploits (1)
The exploit demonstrates an authentication bypass via SQL injection in the login mechanism and a local file inclusion vulnerability in PHP MicroCMS 1.0.1. The SQL injection allows bypassing authentication by injecting malicious input into the username and password fields, while the LFI allows reading arbitrary files by manipulating the 'page' parameter.