CVE-2006-5086
pixel_motion_blog 2.1.1 - Unauthenticated Admin Credential Change via insere_base.php
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-5086. PoCs published by DarkFig.
AI-analyzed exploit summary This exploit targets Blog Pixel Motion V2.1.1, leveraging PHP code execution via stripslashes and SQL injection via urldecode. It provides options to execute arbitrary commands or create an admin account.
Description
Blog Pixel Motion 2.1.1 allows remote attackers to change the username and password for the admin user via a direct request to insere_base.php with modified (1) login and (2) pass parameters. NOTE: this issue was claimed to be SQL injection by the original researcher, but it is not.
Exploits (1)
This exploit targets Blog Pixel Motion V2.1.1, leveraging PHP code execution via stripslashes and SQL injection via urldecode. It provides options to execute arbitrary commands or create an admin account.