CVE-2006-3193
Grayscale BandSite CMS 1.1.1 - Remote Code Execution via root_path Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-3193. PoCs published by Kw3[R]Ln.
AI-analyzed exploit summary This is a writeup describing a remote file inclusion vulnerability in Grayscale BandSite CMS due to an unsanitized $root_path variable. It lists multiple affected endpoints and requires register_globals and allow_url_fopen to be enabled.
Description
Multiple PHP remote file inclusion vulnerabilities in Grayscale BandSite CMS 1.1.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) includes/content/contact_content.php; multiple files in adminpanel/includes/add_forms/ including (2) addbioform.php, (3) addfliersform.php, (4) addgenmerchform.php, (5) addinterviewsform.php, (6) addlinksform.php, (7) addlyricsform.php, (8) addmembioform.php, (9) addmerchform.php, (10) addmerchpicform.php, (11) addnewsform.php, (12) addphotosform.php, (13) addreleaseform.php, (14) addreleasepicform.php, (15) addrelmerchform.php, (16) addreviewsform.php, (17) addshowsform.php, (18) addwearmerchform.php; (19) adminpanel/includes/mailinglist/disphtmltbl.php, and (20) adminpanel/includes/mailinglist/dispxls.php.
Exploits (1)
This is a writeup describing a remote file inclusion vulnerability in Grayscale BandSite CMS due to an unsanitized $root_path variable. It lists multiple affected endpoints and requires register_globals and allow_url_fopen to be enabled.