CVE-2006-3750

Hashcash Component for Joomla! 1.2.1 - Remote Code Execution via mosConfig_absolute_path Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-3750. PoCs published by Matdhule.

AI-analyzed exploit summary This exploit leverages a file inclusion vulnerability in the com_hashcash component for Joomla, allowing remote attackers to include arbitrary files via the mosConfig_absolute_path parameter. The PoC demonstrates remote code execution by including a malicious file from an attacker-controlled server.

Description

PHP remote file inclusion vulnerability in server.php in the Hashcash Component (com_hashcash) 1.2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Matdhule · textwebappsphp

https://www.exploit-db.com/exploits/2026

View Code ZIP pw:eip

This exploit leverages a file inclusion vulnerability in the com_hashcash component for Joomla, allowing remote attackers to include arbitrary files via the mosConfig_absolute_path parameter. The PoC demonstrates remote code execution by including a malicious file from an attacker-controlled server.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: com_hashcash Component 1.2.1

No auth needed

Prerequisites: Target must have the vulnerable com_hashcash component installed · Attacker must be able to host a malicious file on a remote server

MITRE ATT&CK