CVE-2006-2315
ISPConfig < 2.2.2 - Remote Code Execution via session.inc.php go_info Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-2315. PoCs published by ReZEN.
AI-analyzed exploit summary This exploit leverages a remote file inclusion vulnerability in ISPConfig 2.2.2 by injecting a malicious PHP file via the 'go_info[server][classes_root]' parameter. It allows remote command execution by writing a PHP payload to a local file and including it through the vulnerable endpoint.
Description
PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the go_info[server][classes_root] parameter. NOTE: the vendor has disputed this vulnerability, saying that session.inc.php is not under the web root in version 2.2, and register_globals is not enabled
Exploits (1)
This exploit leverages a remote file inclusion vulnerability in ISPConfig 2.2.2 by injecting a malicious PHP file via the 'go_info[server][classes_root]' parameter. It allows remote command execution by writing a PHP payload to a local file and including it through the vulnerable endpoint.