CVE-2006-2767

Ottoman 1.1.2 - Remote Code Execution via Default Path Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-2767. PoCs published by Kacper.

AI-analyzed exploit summary This is a writeup describing remote file inclusion vulnerabilities in Ottoman v1.1.2. It provides URLs with vulnerable parameters but does not include executable exploit code.

Description

PHP remote file inclusion vulnerability in Ottoman 1.1.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the default_path parameter in (1) error.php, (2) index.php, and (3) classes/main_class.php.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Kacper · textwebappsphp
https://www.exploit-db.com/exploits/1854

This is a writeup describing remote file inclusion vulnerabilities in Ottoman v1.1.2. It provides URLs with vulnerable parameters but does not include executable exploit code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: Ottoman v1.1.2
No auth needed
Prerequisites: A vulnerable version of Ottoman · Ability to host malicious scripts on a remote server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (8)

Core 8
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/18208
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/20399
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/2073
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/1854
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/25916
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/25917
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/25918
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/26894

Scores

EPSS 0.0332
EPSS Percentile 87.0%

Details

CWE
CWE-94
Status published
Products (1)
ottoman/ottoman 1.1.2
Published Jun 02, 2006
Tracked Since Feb 18, 2026