CVE-2006-2922
MiraksGalerie 2.62 - Remote File Inclusion via g_pcltar_lib_dir and listconfigfile Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-2922. PoCs published by Federico Fazzi.
AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in MiraksGalerie due to improper input sanitization. An attacker can include arbitrary remote PHP files, leading to remote code execution in the context of the webserver process.
Description
Multiple PHP remote file inclusion vulnerabilities in MiraksGalerie 2.62 allow remote attackers to execute arbitrary PHP code via a URL in the (1) g_pcltar_lib_dir parameter in (a) pcltar.lib.php when register_globals is enabled, and (2) listconfigfile[] parameter in (b) galsecurity.lib.php and (c) galimage.lib.php.
Exploits (2)
This exploit demonstrates a remote file inclusion vulnerability in MiraksGalerie due to improper input sanitization. An attacker can include arbitrary remote PHP files, leading to remote code execution in the context of the webserver process.
This exploit targets multiple remote file inclusion vulnerabilities in MiraksGalerie <= 2.62. It attempts to execute arbitrary commands by injecting malicious PHP code via unsanitized input parameters in specific PHP files.