CVE-2006-1747
Virtual War 1.5.0 - Remote File Inclusion via vwar_root Parameter
Title source: llmExploitation Summary
EIP tracks 7 public exploits for CVE-2006-1747. PoCs published by AG-Spider.
AI-analyzed exploit summary The provided text describes a remote file inclusion vulnerability in VWar 1.5, where unsanitized user input allows arbitrary PHP code execution via the 'vwar_root' parameter. The example URL demonstrates how an attacker could exploit this to execute system commands.
Description
PHP remote file inclusion vulnerability in Virtual War (VWar) 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter to (1) admin/admin.php, (2) war.php, (3) stats.php, (4) news.php, (5) joinus.php, (6) challenge.php, (7) calendar.php, (8) member.php, (9) popup.php, and other unspecified scripts in the admin folder. NOTE: these are different attack vectors than CVE-2006-1636 and CVE-2006-1503.
Exploits (7)
The provided text describes a remote file inclusion vulnerability in VWar 1.5, where unsanitized user input allows arbitrary PHP code execution via the 'vwar_root' parameter. The example URL demonstrates how an attacker could exploit this to execute system commands.
The provided text describes a remote file inclusion vulnerability in VWar 1.5, where unsanitized user input in the 'vwar_root' parameter allows arbitrary PHP code execution. The example URL demonstrates how an attacker could exploit this to execute commands like 'ls'.
The code describes a remote file inclusion vulnerability in VWar 1.5, where unsanitized input in the 'vwar_root' parameter allows arbitrary PHP code execution. The example URL demonstrates how an attacker could exploit this to execute system commands.
The provided text describes a remote file inclusion vulnerability in VWar 1.5, where unsanitized input in the 'vwar_root' parameter allows arbitrary PHP code execution. The example URL demonstrates how an attacker could exploit this to execute system commands.
The provided text describes a remote file inclusion vulnerability in VWar 1.5, where unsanitized input in the 'vwar_root' parameter allows arbitrary remote file inclusion and execution of malicious PHP code. The example URL demonstrates how an attacker could exploit this to execute commands.
The code describes a remote file inclusion vulnerability in VWar 1.5, where unsanitized input in the 'vwar_root' parameter allows arbitrary PHP code execution. The example URL demonstrates how an attacker could exploit this to execute commands like 'ls'.
The code describes a remote file inclusion vulnerability in VWar 1.5, where unsanitized input in the 'vwar_root' parameter allows arbitrary PHP code execution. The example URL demonstrates how an attacker could exploit this to execute system commands.