CVE-2006-2151
phpBB TopList < 1.3.8 - Remote File Inclusion via phpbb_root_path Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-2151. PoCs published by FOX_MULDER, [Oo].
AI-analyzed exploit summary This exploit leverages a remote file inclusion vulnerability in PHPBB TopList <= 1.3.8 by injecting a malicious PHP payload via a crafted HTTP request. It sets up a local listener to serve the payload and triggers its execution on the target server.
Description
PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enabled, allows remote attackers to include arbitrary files via the phpbb_root_path parameter.
Exploits (2)
This exploit leverages a remote file inclusion vulnerability in PHPBB TopList <= 1.3.8 by injecting a malicious PHP payload via a crafted HTTP request. It sets up a local listener to serve the payload and triggers its execution on the target server.
This exploit leverages a remote file inclusion vulnerability in TopList for PHPBB <= 1.3.8 by injecting a malicious URL into the 'phpbb_root_path' parameter, allowing arbitrary command execution via a remote file.