CVE-2012-2939
Travelon Express 6.2.2 - Authenticated Arbitrary File Upload via airline-edit.php hotel-image-add.php or hotel-add.php
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2012-2939. PoCs published by Vulnerability-Lab.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in Travelon Express CMS v6.2.2, including SQL injection, persistent XSS, and arbitrary file upload. It provides detailed PoC examples for each vulnerability, including specific endpoints and payloads.
Description
Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) airline-edit.php, (2) hotel-image-add.php, or (3) hotel-add.php.
Exploits (1)
The exploit demonstrates multiple vulnerabilities in Travelon Express CMS v6.2.2, including SQL injection, persistent XSS, and arbitrary file upload. It provides detailed PoC examples for each vulnerability, including specific endpoints and payloads.