CVE-2006-3395

SiteBuilder-FX 3.5 - Remote Code Execution via admindir Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-3395. PoCs published by MazaGi.

AI-analyzed exploit summary The code describes a remote file inclusion vulnerability in SiteBuilder-FX due to improper input sanitization. An attacker can exploit this to execute arbitrary PHP code by including a remote file via the 'admindir' parameter.

Description

PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by MazaGi · textwebappsphp

https://www.exploit-db.com/exploits/28141

View Code ZIP pw:eip

The code describes a remote file inclusion vulnerability in SiteBuilder-FX due to improper input sanitization. An attacker can exploit this to execute arbitrary PHP code by including a remote file via the 'admindir' parameter.

Classification

Writeup 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Theoretical

Target: SiteBuilder-FX (version not specified)

No auth needed

Prerequisites: Access to the vulnerable URL endpoints · Ability to host a malicious PHP script on a remote server

MITRE ATT&CK