CVE-2006-2685
Basic Analysis and Security Engine <= 1.2.4 - Remote Code Execution via BASE_path Parameter
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2006-2685.
PoCs published by Metasploit, MC, str0ke, including Metasploit module exploits/unix/webapp/base_qry_common.
AI-analyzed exploit summary This Metasploit module exploits a remote file inclusion vulnerability in BASE 1.2.4 and earlier via the base_qry_common.php file. It allows an attacker to include a remote PHP file, potentially leading to remote code execution.
Description
PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and earlier, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BASE_path parameter to (1) base_qry_common.php, (2) base_stat_common.php, and (3) includes/base_include.inc.php.
Exploits (4)
This Metasploit module exploits a remote file inclusion vulnerability in BASE 1.2.4 and earlier via the base_qry_common.php file. It allows an attacker to include a remote PHP file, potentially leading to remote code execution.
This is a Metasploit module exploiting a remote file inclusion vulnerability in BASE 1.2.4 and earlier via the base_qry_common.php file. It allows remote code execution by injecting a malicious PHP include path.
This exploit demonstrates a local file inclusion (LFI) vulnerability in Basic Analysis and Security Engine (BASE) <= 1.2.4, allowing remote attackers to include arbitrary files via the BASE_path parameter in multiple scripts.
This Metasploit module exploits a remote file inclusion vulnerability in BASE 1.2.4 and earlier via the base_qry_common.php file. It allows an attacker to include a remote PHP file by manipulating the BASE_path parameter.