CVE-2006-4291

phlymail_lite < 3.4.4 - Remote Code Execution via _PM_[path][handler] Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-4291. PoCs published by Kacper.

AI-analyzed exploit summary This exploit demonstrates a Remote File Include (RFI) vulnerability in PHlyMail Lite <= 3.4.4 (Build 3.04.04) by manipulating the `_PM_[path][handler]` parameter to include arbitrary remote files. The vulnerability arises from unsanitized user input in the `mod.listmail.php` file.

Description

PHP remote file inclusion vulnerability in handlers/email/mod.listmail.php in PHlyMail Lite 3.4.4 and earlier (Build 3.04.04) allows remote attackers to execute arbitrary PHP code via a URL in the _PM_[path][handler] parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Kacper · textwebappsphp

https://www.exploit-db.com/exploits/2211

View Code ZIP pw:eip

This exploit demonstrates a Remote File Include (RFI) vulnerability in PHlyMail Lite <= 3.4.4 (Build 3.04.04) by manipulating the `_PM_[path][handler]` parameter to include arbitrary remote files. The vulnerability arises from unsanitized user input in the `mod.listmail.php` file.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: PHlyMail Lite <= 3.4.4 (Build 3.04.04)

No auth needed

Prerequisites: Remote file inclusion must be enabled on the target server · Attacker must be able to host a malicious file on an accessible web server

MITRE ATT&CK

T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →