CVE-2006-4044

phpCodeCabinet <= 0.5 - Remote File Inclusion via BEAUT_PATH Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-4044. PoCs published by Minion.

AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in PHPCodeCabinet due to improper sanitization of the $BEAUT_PATH variable in Core.php. An attacker can include a malicious PHP shell by manipulating the BEAUT_PATH parameter.

Description

PHP remote file inclusion vulnerability in Beautifier/Core.php in Brad Fears phpCodeCabinet 0.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the BEAUT_PATH parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Minion · textwebappsphp

https://www.exploit-db.com/exploits/2139

View Code ZIP pw:eip

This exploit demonstrates a remote file inclusion vulnerability in PHPCodeCabinet due to improper sanitization of the $BEAUT_PATH variable in Core.php. An attacker can include a malicious PHP shell by manipulating the BEAUT_PATH parameter.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: PHPCodeCabinet (all versions)

No auth needed

Prerequisites: Access to the target web server · Ability to host a malicious PHP file on an external server

MITRE ATT&CK