CVE-2006-4074

Joomla JD-Wiki < 1.0.2 - Remote Code Execution via mosConfig_absolute_path Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-4074. PoCs published by jank0.

AI-analyzed exploit summary This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in JD-Wiki, a Joomla! integration of DokuWiki. The vulnerability allows an attacker to execute arbitrary commands by injecting a remote shell URL via the 'mosConfig_absolute_path' parameter.

Description

PHP remote file inclusion vulnerability in lib/tpl/default/main.php in the JD-Wiki Component (com_jd-wiki) 1.0.2 and earlier for Joomla!, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by jank0 · textwebappsphp

https://www.exploit-db.com/exploits/2125

View Code ZIP pw:eip

This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in JD-Wiki, a Joomla! integration of DokuWiki. The vulnerability allows an attacker to execute arbitrary commands by injecting a remote shell URL via the 'mosConfig_absolute_path' parameter.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: JD-Wiki (Joomla! integration of DokuWiki)

No auth needed

Prerequisites: Remote shell accessible via URL · Target system with vulnerable JD-Wiki installation

MITRE ATT&CK