This exploit demonstrates a remote PHP code injection vulnerability in HostBill v2.3. The attacker injects malicious PHP code into the 'subject' field of a ticket submission form, which is then executed on the server.
Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target:HostBill v2.3
No auth needed
Prerequisites:Access to the ticket submission form · Base64 encoding of the malicious payload