CVE-2012-1617
OSClass < 2.3.6 - Path Traversal and Arbitrary File Write via Combine.php Type Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2012-1617. PoCs published by Filippo Cavallarin.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload and directory traversal vulnerability in OSClass 2.3.5. It leverages the `combine.php` script to move files and execute arbitrary PHP code by manipulating the `type` and `files` parameters.
Description
Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter. NOTE: this vulnerability can be leveraged to upload arbitrary files.
Exploits (1)
This exploit demonstrates an arbitrary file upload and directory traversal vulnerability in OSClass 2.3.5. It leverages the `combine.php` script to move files and execute arbitrary PHP code by manipulating the `type` and `files` parameters.