CVE-2006-2896

FunkBoard CF0.71 - Unauthenticated Arbitrary Password Change via Profile Edit UID Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-2896. PoCs published by ajann.

AI-analyzed exploit summary This HTML form exploits CVE-2006-2896, a vulnerability in profile.php that allows arbitrary file uploads by manipulating the form action. The PoC demonstrates how an attacker can bypass restrictions to upload malicious files.

Description

profile.php in FunkBoard CF0.71 allows remote attackers to change arbitrary passwords via a modified uid hidden form field in an Edit Profile action.

Exploits (1)

exploitdb WORKING POC VERIFIED

by ajann · htmlwebappsphp

https://www.exploit-db.com/exploits/1875

View Code ZIP pw:eip

This HTML form exploits CVE-2006-2896, a vulnerability in profile.php that allows arbitrary file uploads by manipulating the form action. The PoC demonstrates how an attacker can bypass restrictions to upload malicious files.

Classification

Working Poc 90%

Attack Type

Other

Complexity

Trivial

Reliability

Reliable

Target: profile.php (specific version not specified)

Auth required

Prerequisites: Access to the vulnerable profile.php page · Valid user credentials

MITRE ATT&CK