CVE-2006-4591

AlstraSoft Template Seller <3.25 - RCE

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-4591. PoCs published by night_warrior771.

AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in AlstraSoft Template Seller. An attacker can include arbitrary remote PHP code via the 'config[template_path]' parameter in payment_result.php, leading to remote code execution.

Description

Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25, allow remote attackers to execute arbitrary PHP code via a URL in the config[template_path] parameter to (1) payment/payment_result.php or (2) /payment/spuser_result.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by night_warrior771 · textwebappsphp

https://www.exploit-db.com/exploits/28444

View Code ZIP pw:eip

This exploit demonstrates a remote file inclusion vulnerability in AlstraSoft Template Seller. An attacker can include arbitrary remote PHP code via the 'config[template_path]' parameter in payment_result.php, leading to remote code execution.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: AlstraSoft Template Seller (version not specified)

No auth needed

Prerequisites: Remote file inclusion must be enabled on the target server · Attacker must be able to host a malicious PHP file on an accessible web server

MITRE ATT&CK

T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →