CVE-2006-2284

Claroline 1.7.5 - Remote File Inclusion via clarolineRepositorySys or claro_CasLibPath Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-2284. PoCs published by beford.

AI-analyzed exploit summary This Perl script exploits a remote file inclusion vulnerability in Claroline 1.7.5 by injecting a malicious URL into the 'clarolineRepositorySys' parameter, allowing arbitrary command execution via a remote shell.

Description

Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) clarolineRepositorySys parameter in ldap.inc.php and the (2) claro_CasLibPath parameter in casProcess.inc.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by beford · perlwebappsphp

https://www.exploit-db.com/exploits/1766

View Code ZIP pw:eip

This Perl script exploits a remote file inclusion vulnerability in Claroline 1.7.5 by injecting a malicious URL into the 'clarolineRepositorySys' parameter, allowing arbitrary command execution via a remote shell.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Claroline Open Source e-Learning 1.7.5

No auth needed

Prerequisites: Remote shell script accessible via URL · Network access to the vulnerable Claroline instance

MITRE ATT&CK