Exploitation Summary
EIP tracks 1 public exploit for CVE-2006-4961. PoCs published by Kacper.
AI-analyzed exploit summary This exploit leverages a combination of SQL injection and XSS vulnerabilities in PhpBlueDragon CMS <= 2.9 to achieve remote code execution by injecting malicious PHP code into the registration and login forms, then triggering execution via a log file inclusion vulnerability.
Description
SQL injection vulnerability in the GetModuleConfig function in public_includes/pub_kernel/pbd_modules.php in Php Blue Dragon 2.9.1 and earlier allows remote attackers to execute arbitrary SQL commands via the m parameter to index.php.
Exploits (1)
This exploit leverages a combination of SQL injection and XSS vulnerabilities in PhpBlueDragon CMS <= 2.9 to achieve remote code execution by injecting malicious PHP code into the registration and login forms, then triggering execution via a log file inclusion vulnerability.