CVE-2010-4330
Pulse CMS < 1.2.9 - Remote File Inclusion via Path Traversal in p Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-4330. PoCs published by Mark Stanislav.
AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Pulse CMS Basic versions prior to 1.2.9. The vulnerability is exploited via a null-byte attack in the 'p' parameter of the 'index.php' script, allowing arbitrary file reads when 'magic_quotes_gpc' is disabled.
Description
Directory traversal vulnerability in includes/controller.php in Pulse CMS Basic before 1.2.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter to index.php.
Exploits (1)
This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Pulse CMS Basic versions prior to 1.2.9. The vulnerability is exploited via a null-byte attack in the 'p' parameter of the 'index.php' script, allowing arbitrary file reads when 'magic_quotes_gpc' is disabled.