EDB-2415

functional

exV2 < 2.0.4.3 - 'extract()' Remote Command Execution

view exploit source exploit_dbverifiedtype webappsauthor rgodpublished 2006-09-22catalog exploit_db

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2006-7079US	critical9.8	12.9% (96th)	Exploit	2007-03-02
Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal…
CVE-2006-7080US	medium4.3	4.72% (92nd)	Exploit	2007-03-02
Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the old_avatar pa…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.