CVE-2006-4631
SoftBB < 0.1 - Authenticated Direct Static Code Injection via cache_forum Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-4631. PoCs published by DarkFig, Kacper.
AI-analyzed exploit summary This exploit targets SoftBB 0.1 by leveraging an authenticated PHP code execution vulnerability. It bypasses security mechanisms like magic_quotes_gpc and register_globals to inject a shellcode payload into the application's configuration, allowing remote command execution.
Description
Direct static code injection vulnerability in admin/save_opt.php in SoftBB 0.1, and possibly earlier, allows remote authenticated users to upload and execute arbitrary PHP code via the cache_forum parameter, which saves the code to info_options.php, which is accessible via a direct request.
Exploits (2)
This exploit targets SoftBB 0.1 by leveraging an authenticated PHP code execution vulnerability. It bypasses security mechanisms like magic_quotes_gpc and register_globals to inject a shellcode payload into the application's configuration, allowing remote command execution.
This exploit targets a local file inclusion vulnerability in PHP-Proxima 6.0, allowing arbitrary file reading and remote code execution via crafted HTTP requests. It automates the attack by testing multiple log file paths and injecting commands through the vulnerable 'bb_smilies.php' script.