CVE-2006-4215
Zen Cart < 1.3.0.2 - Remote Code Execution via autoLoadConfig Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-4215. PoCs published by GulfTech Security.
AI-analyzed exploit summary The exploit demonstrates a remote file inclusion vulnerability in Zen Cart by manipulating the 'autoLoadConfig' parameter to include arbitrary remote files. This allows an attacker to execute malicious PHP code in the context of the webserver process.
Description
PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the autoLoadConfig[999][0][loadFile] parameter.
Exploits (1)
The exploit demonstrates a remote file inclusion vulnerability in Zen Cart by manipulating the 'autoLoadConfig' parameter to include arbitrary remote files. This allows an attacker to execute malicious PHP code in the context of the webserver process.