CVE-2006-4531
Pheap CMS < 1.1 - Remote File Inclusion via lpref Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-4531. PoCs published by Kacper.
AI-analyzed exploit summary This exploit targets a Remote File Include (RFI) vulnerability in Pheap CMS <= 1 by injecting a malicious URL into the 'lpref' parameter, allowing arbitrary command execution via a remote shell script. The script uses LWP::UserAgent to send crafted HTTP requests and interact with the compromised system.
Description
PHP remote file inclusion vulnerability in lib/config.php in Pheap CMS 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the lpref parameter.
Exploits (1)
This exploit targets a Remote File Include (RFI) vulnerability in Pheap CMS <= 1 by injecting a malicious URL into the 'lpref' parameter, allowing arbitrary command execution via a remote shell script. The script uses LWP::UserAgent to send crafted HTTP requests and interact with the compromised system.