CVE-2006-4596
mybace_light - Remote File Inclusion via hauptverzeichniss or template_back Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-4596. PoCs published by Philipp Niedziela.
AI-analyzed exploit summary This is an advisory detailing a Remote File Inclusion (RFI) vulnerability in MyBace Light, specifically in the `includes/login_check.php` and `admin/login/content/user_daten.php` files. The vulnerability arises due to improper sanitization of the `$hauptverzeichniss` and `$template_back` variables, allowing remote file execution.
Description
PHP remote file inclusion in MyBace Light Skrip, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the (1) hauptverzeichniss parameter in includes/login_check.php and the (2) template_back parameter in admin/login/content/user_daten.php.
Exploits (1)
This is an advisory detailing a Remote File Inclusion (RFI) vulnerability in MyBace Light, specifically in the `includes/login_check.php` and `admin/login/content/user_daten.php` files. The vulnerability arises due to improper sanitization of the `$hauptverzeichniss` and `$template_back` variables, allowing remote file execution.