CVE-2005-2782

AutoLinks Pro 2.1 - Remote File Inclusion via alpath Parameter FTP URL Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-2782. PoCs published by 4Degrees.

AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in AutoLinks Pro due to unsanitized user input in the 'alpath' parameter. An attacker can execute arbitrary server-side script code by including a remote file via FTP.

Description

PHP remote file inclusion vulnerability in al_initialize.php for AutoLinks Pro 2.1 allows remote attackers to execute arbitrary PHP code via an "ftp://" URL in the alpath parameter, which bypasses the incomplete blacklist that only checks for "http" and "https" URLs.

Exploits (1)

exploitdb WORKING POC VERIFIED
by 4Degrees · textwebappsphp
https://www.exploit-db.com/exploits/26208

This exploit demonstrates a remote file inclusion vulnerability in AutoLinks Pro due to unsanitized user input in the 'alpath' parameter. An attacker can execute arbitrary server-side script code by including a remote file via FTP.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: AutoLinks Pro
No auth needed
Prerequisites: Remote server hosting malicious script · Network access to the target
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=112535379716486&w=2
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/14686
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16620/
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/22061

Scores

EPSS 0.0267
EPSS Percentile 84.2%

Details

Status published
Products (1)
autolinks/autolinks 2.1
Published Sep 02, 2005
Tracked Since Feb 18, 2026