CVE-2006-0713
LinPHA 1.0 - Directory Traversal and Arbitrary File Inclusion via Lang Parameter
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2006-0713. PoCs published by rgod.
AI-analyzed exploit summary The provided text describes multiple local file-inclusion and PHP code-injection vulnerabilities in LinPHA due to insecure use of 'include_once()' and insufficient input validation. It includes example URLs demonstrating the exploitation vectors but lacks actual exploit code.
Description
Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.
Exploits (4)
The provided text describes multiple local file-inclusion and PHP code-injection vulnerabilities in LinPHA due to insecure use of 'include_once()' and insufficient input validation. It includes example URLs demonstrating the exploitation vectors but lacks actual exploit code.
The provided text describes multiple vulnerabilities in LinPHA, including local file inclusion and PHP code injection via insecure use of 'include_once()' and insufficient input validation in log files. It outlines how an attacker can exploit these to read arbitrary files or execute PHP code in the context of the web server.
The exploit describes multiple local file-inclusion and PHP code-injection vulnerabilities in LinPHA due to insecure use of 'include_once()' and insufficient input validation. It provides a proof-of-concept URL to demonstrate the file-inclusion vulnerability.
This exploit demonstrates a local file inclusion vulnerability in LinPHA by manipulating the 'language' parameter in a POST request to traverse directories and include arbitrary files. It also highlights PHP code injection via log files due to insufficient input validation.