CVE-2005-3926
GuppY 4.5.9 - Remote Code Execution via _SERVER[REMOTE_ADDR] Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2005-3926. PoCs published by rgod.
AI-analyzed exploit summary This exploit targets Guppy CMS <=4.5.9 by overwriting the _SERVER[REMOTE_ADDR] variable to inject arbitrary PHP code, enabling remote command execution. The script provides a web interface to input target details and execute commands.
Description
Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via the _SERVER[REMOTE_ADDR] parameter, which is injected into a .inc script that is later included by the main script.
Exploits (1)
This exploit targets Guppy CMS <=4.5.9 by overwriting the _SERVER[REMOTE_ADDR] variable to inject arbitrary PHP code, enabling remote command execution. The script provides a web interface to input target details and execute commands.