CVE-2006-4672

ppalCart 2.5 EE - Remote Code Execution via proMod or docroot Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-4672. PoCs published by momo26.

AI-analyzed exploit summary This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in ppalCart 2.5 EE. The vulnerability allows an attacker to include and execute arbitrary remote PHP files via the 'proMod' or 'docroot' parameters in index.php or mainpage.php.

Description

PHP remote file inclusion vulnerability in profitCode ppalCart 2.5 EE, possibly a component of PayProCart, allows remote attackers to execute arbitrary PHP code via a URL in the (1) proMod parameter to (a) index.php, or the (2) docroot parameter to (b) index.php or (c) mainpage.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by momo26 · textwebappsphp

https://www.exploit-db.com/exploits/2316

View Code ZIP pw:eip

This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in ppalCart 2.5 EE. The vulnerability allows an attacker to include and execute arbitrary remote PHP files via the 'proMod' or 'docroot' parameters in index.php or mainpage.php.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: ppalCart 2.5 EE

No auth needed

Prerequisites: Remote file inclusion must be enabled on the target server · Attacker must be able to host a malicious PHP file on an accessible web server

MITRE ATT&CK

T1189 - Drive-by Compromise T1210 - Exploitation of Remote Services

mistral-large-3 · analyzed Feb 16, 2026 Full analysis →