Exploitation Summary
EIP tracks 2 public exploits for CVE-2006-4962. PoCs published by Kacper.
AI-analyzed exploit summary This exploit targets Php Blue Dragon CMS 3.0.0 by leveraging a local file inclusion vulnerability to execute arbitrary commands via log file poisoning. It authenticates as a registered user and attempts to include malicious PHP code from server log files.
Description
Directory traversal vulnerability in pbd_engine.php in Php Blue Dragon 2.9.1 and earlier allows remote attackers to read and execute arbitrary local files via a .. (dot dot) sequence via the phpExt parameter, as demonstrated by executing PHP code in a log file.
Exploits (2)
This exploit targets Php Blue Dragon CMS 3.0.0 by leveraging a local file inclusion vulnerability to execute arbitrary commands via log file poisoning. It authenticates as a registered user and attempts to include malicious PHP code from server log files.
This exploit leverages a combination of SQL injection and XSS vulnerabilities in PhpBlueDragon CMS <= 2.9 to achieve remote code execution by injecting malicious PHP code into the registration and login forms, then triggering execution via a log file inclusion vulnerability.