Exploitation Summary
EIP tracks 1 public exploit for CVE-2006-4721. PoCs published by Kacper.
AI-analyzed exploit summary This exploit targets CVE-2006-4721 in CCleague Pro Sports CMS <= 1.0.1RC1 by injecting arbitrary commands via a maliciously crafted Cookie header. It leverages path traversal to log the command into Apache log files, which are then executed due to improper input validation.
Description
Directory traversal vulnerability in admin.php in CCleague Pro Sports CMS 1.0.1 RC1 allows remote attackers to read and execute arbitrary local files via a .. (dot dot) sequence and trailing null (%00) byte in the language Cookie parameter, as demonstrated by executing PHP code via a log file.
Exploits (1)
This exploit targets CVE-2006-4721 in CCleague Pro Sports CMS <= 1.0.1RC1 by injecting arbitrary commands via a maliciously crafted Cookie header. It leverages path traversal to log the command into Apache log files, which are then executed due to improper input validation.