CVE-2006-5076
OpenConcept Back-End 0.4.5 - Remote File Inclusion via includes_path Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2006-5076. PoCs published by Root3r_H3ll.
AI-analyzed exploit summary The code describes a remote file inclusion vulnerability in Back-End CMS 0.4.5 due to improper input sanitization. An attacker can exploit this by manipulating the 'includes_path' parameter in search.php to execute arbitrary server-side script code.
Description
Multiple PHP remote file inclusion vulnerabilities in OpenConcept Back-End 0.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the includes_path parameter in (1) admin/index.php, (2) Facts.php, or (3) search.php.
Exploits (3)
The code describes a remote file inclusion vulnerability in Back-End CMS 0.4.5 due to improper input sanitization. An attacker can exploit this by manipulating the 'includes_path' parameter in search.php to execute arbitrary server-side script code.
The code describes a remote file inclusion vulnerability in Back-End CMS 0.4.5 due to improper input sanitization. An attacker can exploit this by manipulating the 'includes_path' parameter to execute arbitrary server-side script code.
This exploit leverages a remote file inclusion vulnerability in Back-End CMS 0.4.5 by injecting a malicious URL into the 'includes_path' parameter, allowing arbitrary command execution via a remote shell script. The PoC sends HTTP requests to execute commands fetched from an attacker-controlled server.