Exploitation Summary
EIP tracks 10 public exploits for CVE-2006-4477. PoCs published by DarkFig.
AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in ezContents due to improper input sanitization. An attacker can include and execute arbitrary remote PHP code via manipulated GLOBALS parameters.
Description
Multiple PHP remote file inclusion vulnerabilities in Visual Shapers ezContents 2.0.3 allow remote attackers to execute arbitrary PHP code via an empty GLOBALS[rootdp] parameter and an ftps URL in the (1) GLOBALS[admin_home] parameter in (a) diary/event_list.php, (b) gallery/gallery_summary.php, (c) guestbook/showguestbook.php, (d) links/showlinks.php, and (e) reviews/review_summary.php; and the (2) GLOBALS[language_home] parameter in (f) calendar/calendar.php, (g) news/shownews.php, (h) poll/showpoll.php, (i) search/search.php, (j) toprated/toprated.php, and (k) whatsnew/whatsnew.php.
Exploits (10)
This exploit demonstrates a remote file inclusion vulnerability in ezContents due to improper input sanitization. An attacker can include and execute arbitrary remote PHP code via manipulated GLOBALS parameters.
This exploit leverages a remote file inclusion vulnerability in ezContents due to improper input sanitization. An attacker can include and execute arbitrary PHP code from a remote server by manipulating the `GLOBALS[rootdp]` and `GLOBALS[language_home]` parameters.
The provided text describes a remote file inclusion vulnerability in ezContents, where unsanitized user input allows an attacker to include and execute arbitrary remote PHP code via manipulated GLOBALS parameters. The example URL demonstrates exploiting the vulnerability to execute a command (ls).
This exploit demonstrates a remote file inclusion vulnerability in ezContents by manipulating the GLOBALS array to include and execute arbitrary PHP code from a remote server. The attack leverages improper input sanitization to achieve remote code execution.
This exploit demonstrates a remote file inclusion vulnerability in ezContents by manipulating the `GLOBALS[rootdp]` and `GLOBALS[admin_home]` parameters to include and execute arbitrary PHP code from a remote server.
This exploit demonstrates a remote file inclusion vulnerability in ezContents due to improper input sanitization. An attacker can include arbitrary remote PHP code via manipulated GLOBALS parameters in the URL.
This exploit demonstrates a remote file inclusion vulnerability in ezContents by manipulating the GLOBALS array to include and execute arbitrary PHP code from a remote server. The attack leverages improper input sanitization to achieve remote code execution.
This exploit demonstrates a remote file inclusion vulnerability in ezContents by manipulating the GLOBALS array to include and execute arbitrary PHP code from a remote server. The attack leverages improper input sanitization to achieve remote code execution.
This exploit demonstrates a remote file inclusion vulnerability in ezContents by manipulating the 'GLOBALS[rootdp]' and 'GLOBALS[language_home]' parameters to include and execute arbitrary PHP code from a remote server. The attack leverages improper input sanitization to achieve remote code execution.
This exploit demonstrates a remote file inclusion vulnerability in ezContents by manipulating the `GLOBALS[rootdp]` and `GLOBALS[admin_home]` parameters to include and execute arbitrary PHP code from a remote server. The attack leverages improper input sanitization to achieve remote code execution.