CVE-2006-3989

Knusperleicht Shoutbox < 4.4 - Remote File Inclusion via sb_include_path Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-3989. PoCs published by Kurdish Security.

AI-analyzed exploit summary This exploit leverages a file inclusion vulnerability in ShoutBox by manipulating the 'sb_include_path' parameter to include and execute arbitrary remote code. The PoC demonstrates remote command execution via a crafted URL.

Description

PHP remote file inclusion vulnerability in index.php in Knusperleicht Shoutbox 4.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sb_include_path parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Kurdish Security · textwebappsphp

https://www.exploit-db.com/exploits/2103

View Code ZIP pw:eip

This exploit leverages a file inclusion vulnerability in ShoutBox by manipulating the 'sb_include_path' parameter to include and execute arbitrary remote code. The PoC demonstrates remote command execution via a crafted URL.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: ShoutBox (version not specified)

No auth needed

Prerequisites: Remote file inclusion must be enabled on the target server · Attacker must host a malicious file on a remote server

MITRE ATT&CK