A look at CVE-2015–6967

Or why you should never trust user-supplied data.

As promised in my previous blog post, in this post, I’ll take a look at CVE-2015–6967, a file upload vulnerability affecting Nibbleblog version 4.0.3, and write a custom script to exploit it.

The vulnerability

The vulnerability was found in 2015, allowing an attacker to upload a PHP script and execute remote commands. With that, I could call this a day, but where is the fun in that? Let’s take a …

blog blog post call cve data exploit file file upload fun htb machine opsec php privileges script trust version vulnerability