Exploitation Summary
EIP tracks 1 public exploit for CVE-2006-4920. PoCs published by simo64.
AI-analyzed exploit summary This exploit demonstrates a remote file upload vulnerability in Site@School 2.4.02 and below, allowing arbitrary command execution via a malicious PHP file upload. The PoC uploads a shell script and provides interactive command execution.
Description
Multiple PHP remote file inclusion vulnerabilities in Site@School (S@S) 2.4.02 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the cmsdir parameter to (1) starnet/modules/sn_allbum/slideshow.php, and (2) starnet/themes/editable/main.inc.php.
Exploits (1)
This exploit demonstrates a remote file upload vulnerability in Site@School 2.4.02 and below, allowing arbitrary command execution via a malicious PHP file upload. The PoC uploads a shell script and provides interactive command execution.