CVE-2006-1781
Circle R Monster Top List < 1.4.2 - Remote Code Execution via Root Path Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-1781. PoCs published by fluffy_bunny, r0t.
AI-analyzed exploit summary This Perl script exploits a remote file inclusion (RFI) vulnerability in Monster Top List <= 1.4.2 by injecting a malicious URL into the 'root_path' parameter, allowing remote command execution. It uses LWP::Simple to send HTTP requests and interact with the target system.
Description
PHP remote file inclusion vulnerability in functions.php in Circle R Monster Top List (MTL) 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter. NOTE: It was later reported that 1.4.2 and earlier are affected.
Exploits (2)
This Perl script exploits a remote file inclusion (RFI) vulnerability in Monster Top List <= 1.4.2 by injecting a malicious URL into the 'root_path' parameter, allowing remote command execution. It uses LWP::Simple to send HTTP requests and interact with the target system.
The provided text describes a remote file inclusion vulnerability in Monster Top List due to unsanitized user input in the 'root_path' parameter. An attacker can exploit this to execute arbitrary PHP code by including a remote file.