This exploit targets Oxwall 1.7.0 by leveraging an authenticated file upload vulnerability to execute arbitrary PHP code. It bypasses .htaccess restrictions by uploading a malicious file with a .php5 extension via the 'bigAvatar' parameter.
Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target:Oxwall 1.7.0 (build 7907 and 7906)
Auth required
Prerequisites:Valid credentials for Oxwall admin panel · Network access to the target