Exploitation Summary
EIP tracks 1 public exploit for CVE-2012-1671. PoCs published by Mark Stanislav.
AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in phpPaleo via a null-byte attack on the 'lang' GET parameter. It allows reading arbitrary files (e.g., /etc/passwd) when magic_quotes_gpc is disabled and PHP is < 5.3.4.
Description
Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
Exploits (1)
This exploit demonstrates a Local File Inclusion (LFI) vulnerability in phpPaleo via a null-byte attack on the 'lang' GET parameter. It allows reading arbitrary files (e.g., /etc/passwd) when magic_quotes_gpc is disabled and PHP is < 5.3.4.