CVE-2006-1551
PAJAX 0.5.1 - Remote Code Execution via pajax_call_dispatcher.php Method and Args Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-1551.
PoCs published by Metasploit, including Metasploit module exploits/unix/webapp/pajax_remote_exec.
AI-analyzed exploit summary This Metasploit module exploits a remote command execution vulnerability in PAJAX <= 0.5.1 by injecting arbitrary PHP code via unchecked user input in the 'method' parameter of a JSON payload. The exploit sends a POST request to 'pajax_call_dispatcher.php' with a malicious payload embedded in the 'method' field.
Description
Eval injection vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via the (1) $method and (2) $args parameters.
Exploits (2)
This Metasploit module exploits a remote command execution vulnerability in PAJAX <= 0.5.1 by injecting arbitrary PHP code via unchecked user input in the 'method' parameter of a JSON payload. The exploit sends a POST request to 'pajax_call_dispatcher.php' with a malicious payload embedded in the 'method' field.
This Metasploit module exploits a remote command execution vulnerability in PAJAX <= 0.5.1 by injecting arbitrary PHP code via unchecked user input in the 'method' parameter. The exploit sends a crafted JSON payload to the target URI, triggering code execution.