CVE-2006-3562
plume_cms 1.0.4 - Remote Code Execution via _PX_config[manager_path] Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2006-3562. PoCs published by CrAsh_oVeR_rIdE.
AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in Plume CMS due to improper input sanitization. An attacker can execute arbitrary server-side script code by manipulating the `_PX_config[manager_path]` parameter in `rss.php`.
Description
PHP remote file inclusion vulnerabilities in plume cms 1.0.4 allow remote attackers to execute arbitrary PHP code via a URL in the _PX_config[manager_path] parameter to (1) index.php, (2) rss.php, or (3) search.php, a different set of vectors and versions than CVE-2006-2645 and CVE-2006-0725.
Exploits (3)
This exploit demonstrates a remote file inclusion vulnerability in Plume CMS due to improper input sanitization. An attacker can execute arbitrary server-side script code by manipulating the `_PX_config[manager_path]` parameter in `rss.php`.
This exploit demonstrates a remote file inclusion vulnerability in Plume CMS due to improper input sanitization. An attacker can execute arbitrary server-side script code by manipulating the `_PX_config[manager_path]` parameter.
This exploit demonstrates a remote file inclusion vulnerability in Plume CMS by manipulating the `_PX_config[manager_path]` parameter in `search.php` to include arbitrary remote files. The vulnerability arises due to insufficient input sanitization, allowing an attacker to execute server-side script code with webserver privileges.