Exploitation Summary
EIP tracks 1 public exploit for CVE-2006-5137. PoCs published by HACKERS PAL.
AI-analyzed exploit summary This exploit targets UBB.threads 6.5.1.1 by leveraging an input validation error to achieve remote command execution. It manipulates the 'config[path]' parameter to include a malicious file, enabling arbitrary command execution via 'calendar.php'.
Description
Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme[] array parameter to admin/doedittheme.php, which is injected into includes/theme.inc.php; (2) inject PHP code via a config[] array parameter to admin/doeditconfig.php, and then execute the code via includes/config.inc.php; and inject a reference to PHP code via a URL in the config[path] parameter, and then execute the code via (3) dorateuser.php, (4) calendar.php, and unspecified other scripts.
Exploits (1)
This exploit targets UBB.threads 6.5.1.1 by leveraging an input validation error to achieve remote command execution. It manipulates the 'config[path]' parameter to include a malicious file, enabling arbitrary command execution via 'calendar.php'.