CVE-2006-1662
Limbo CMS 1.0.4.1-1.0.4.2 - Remote Code Execution via Itemid Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-1662. PoCs published by sirh0t, str0ke.
AI-analyzed exploit summary This is a Metasploit module exploiting a remote code execution vulnerability in Limbo CMS 1.x via arbitrary PHP code execution through the 'option' and 'Itemid' parameters. It supports multiple execution methods (system, exec, shell_exec, passthru) and includes a test mode to check for vulnerability.
Description
The frontpage option in Limbo CMS 1.0.4.2 and 1.0.4.1 allows remote attackers to execute arbitrary PHP commands via the Itemid parameter in index.php.
Exploits (2)
This is a Metasploit module exploiting a remote code execution vulnerability in Limbo CMS 1.x via arbitrary PHP code execution through the 'option' and 'Itemid' parameters. It supports multiple execution methods (system, exec, shell_exec, passthru) and includes a test mode to check for vulnerability.
This Perl script exploits a remote code execution vulnerability in Limbo CMS <= 1.0.4.2 by injecting a malicious payload into the 'Itemid' parameter via the 'passthru' function. The exploit sends a crafted HTTP request to execute arbitrary commands on the target system.