CVE-2006-2608
artmedic newsletter 4.1 - Arbitrary File Write and Remote Code Execution via logfile Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-2608. PoCs published by C.Schmitz.
AI-analyzed exploit summary This exploit leverages a remote PHP code execution vulnerability in Artmedic Newsletter due to improper input sanitization. The attacker can inject arbitrary PHP code via the 'email' parameter, leading to remote code execution in the context of the webserver process.
Description
artmedic newsletter 4.1 and possibly other versions, when register_globals is enabled, allows remote attackers to modify arbitrary files and execute arbitrary PHP code via the logfile parameter in a direct request to log.php, which causes the $logfile variable to be redefined to an attacker-controlled value, as demonstrated by injecting PHP code into info.php.
Exploits (1)
This exploit leverages a remote PHP code execution vulnerability in Artmedic Newsletter due to improper input sanitization. The attacker can inject arbitrary PHP code via the 'email' parameter, leading to remote code execution in the context of the webserver process.