CVE-2006-1749
phpListPro <= 2.01 - Remote Code Execution via config.php returnpath Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-1749.
AI-analyzed exploit summary The exploit demonstrates a remote file inclusion vulnerability in phpListPro <= 2.01 by injecting a malicious URL into the 'returnpath' parameter, allowing arbitrary code execution. The provided URLs show how an attacker can include a remote script to execute commands like 'ls -laF'.
Description
PHP remote file inclusion vulnerability in config.php in phpListPro 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the returnpath parameter. NOTE: this issue was later reported to affect 2.01 as well.
Exploits (1)
The exploit demonstrates a remote file inclusion vulnerability in phpListPro <= 2.01 by injecting a malicious URL into the 'returnpath' parameter, allowing arbitrary code execution. The provided URLs show how an attacker can include a remote script to execute commands like 'ls -laF'.