CVE-2006-4558
DeluxeBB < 1.06 - Remote Code Execution via Double Extension File Upload
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-4558. PoCs published by rgod.
AI-analyzed exploit summary This exploit targets DeluxeBB <= v1.06 by uploading a malicious PHP file disguised as an attachment with a double extension (e.g., .php.php.rar). The exploit leverages Apache's mod_mime to execute the uploaded PHP code, achieving remote command execution (RCE).
Description
DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php.
Exploits (1)
This exploit targets DeluxeBB <= v1.06 by uploading a malicious PHP file disguised as an attachment with a double extension (e.g., .php.php.rar). The exploit leverages Apache's mod_mime to execute the uploaded PHP code, achieving remote command execution (RCE).