CVE-2006-0659

RunCMS < 1.2 - Remote Code Execution via bbPath[path] Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-0659.

AI-analyzed exploit summary This PHP script exploits a remote file inclusion vulnerability in RunCMS versions <= 1.2 and a file upload vulnerability in RunCMS 1.3a via FCKEditor. It allows arbitrary command execution by including remote or local files through manipulated paths.

Description

Multiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier, with register_globals and allow_url_fopen enabled, allow remote attackers to execute arbitrary code via the bbPath[path] parameter in (1) class.forumposts.php and (2) forumpollrenderer.php.

Exploits (1)

exploitdb WORKING POC

phpwebappsphp

https://www.exploit-db.com/exploits/1485

View Code ZIP pw:eip

This PHP script exploits a remote file inclusion vulnerability in RunCMS versions <= 1.2 and a file upload vulnerability in RunCMS 1.3a via FCKEditor. It allows arbitrary command execution by including remote or local files through manipulated paths.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: RunCMS <= 1.3a

No auth needed

Prerequisites: register_globals = On & allow_url_fopen = On (for remote inclusion) · magic_quotes_gpc = Off (for local inclusion) · FCKEditor integration (for file upload)

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 19, 2026 Full analysis →