CVE-2006-4026
SAPID CMS 123 rc3 - Remote Code Execution via root_path Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-4026. PoCs published by Kacper.
AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in SAPID CMS <= v. 1.2.3.05 by manipulating the 'root_path' parameter in two PHP scripts. It allows an attacker to include and execute arbitrary remote scripts.
Description
PHP remote file inclusion vulnerability in SAPID CMS 123 rc3 allows remote attackers to execute arbitrary PHP code via a URL in the (1) root_path parameter in usr/extensions/get_infochannel.inc.php and the (2) GLOBALS["root_path"] parameter in usr/extensions/get_tree.inc.php.
Exploits (1)
This exploit demonstrates a remote file inclusion vulnerability in SAPID CMS <= v. 1.2.3.05 by manipulating the 'root_path' parameter in two PHP scripts. It allows an attacker to include and execute arbitrary remote scripts.