Exploitation Summary
EIP tracks 21 public exploits for CVE-2006-4889. PoCs published by ThE_LeO, SHiKaA.
AI-analyzed exploit summary The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in 'smile.php'. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
Description
Multiple PHP remote file inclusion vulnerabilities in Telekorn SignKorn Guestbook (SL) 1.3 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the dir_path parameter in (1) index.php, (2) includes/functions.gb.php, (3) includes/functions.admin.php, (4) includes/admin.inc.php, (5) help.php, (6) smile.php, (7) entry.php; (8) adminhelp0.php, (9) adminhelp1.php, (10) adminhelp2.php, and (11) adminhelp3.php in (a) help/en and (b) help/de directories; and the (12) preview.php, (13) log.php, (14) index.php, (15) config.php, and (16) admin.php in the (c) admin directory, a different set of vectors than CVE-2006-4788.
Exploits (21)
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in 'smile.php'. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in the index.php script. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in help.php. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in 'entry.php'. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in the 'functions.gb.php' script. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in the 'functions.admin.php' script. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in admin.inc.php. This allows an attacker to include arbitrary remote files, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in adminhelp3.php. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook 1.3 and earlier. The vulnerability arises from insufficient sanitization of the 'dir_path' parameter in 'adminhelp2.php', allowing an attacker to include and execute arbitrary remote files.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by injecting a malicious script path via the 'dir_path' parameter in adminhelp1.php. This allows an attacker to execute arbitrary code on the server due to insufficient input sanitization.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by injecting a malicious script path via the 'dir_path' parameter in adminhelp0.php. This allows an attacker to execute arbitrary code on the server.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in 'adminhelp3.php'. This allows an attacker to include arbitrary remote files, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook 1.3 and earlier. The attacker can inject arbitrary PHP code via the 'dir_path' parameter in adminhelp2.php, leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by injecting a malicious script path via the 'dir_path' parameter in adminhelp1.php. This allows an attacker to execute arbitrary code on the target system.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by injecting a malicious script path via the 'dir_path' parameter in 'adminhelp0.php'. This allows an attacker to execute arbitrary code on the server.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in 'preview.php'. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in 'admin/log.php'. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in the admin/index.php script. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in 'config.php'. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
The exploit demonstrates a remote file inclusion vulnerability in Telekorn Signkorn Guestbook by manipulating the 'dir_path' parameter in admin.php. This allows an attacker to include and execute arbitrary remote scripts, potentially leading to remote code execution.
This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in Signkorn Guestbook <= v1.3. The vulnerability is due to improper input validation in the 'dir_path' parameter in includes/log.inc.php, allowing an attacker to include and execute arbitrary remote files.