Exploitation Summary
EIP tracks 1 public exploit for CVE-2006-1260. PoCs published by Eugene Minaev.
AI-analyzed exploit summary This exploit leverages a nullbyte injection in the `parse_url` function to bypass host validation in Horde Web-Mail, allowing remote file disclosure. The vulnerability arises from improper handling of nullbytes in the URL parsing logic.
Description
Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check.
Exploits (1)
This exploit leverages a nullbyte injection in the `parse_url` function to bypass host validation in Horde Web-Mail, allowing remote file disclosure. The vulnerability arises from improper handling of nullbytes in the URL parsing logic.