CVE-2006-5244
OpenDock Easy Blog < 1.4 - Remote File Inclusion via doc_directory Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-5244. PoCs published by the_day.
AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in OpenDock Easy Doc <=1.4, where the 'doc_directory' parameter in multiple PHP scripts is not properly sanitized, allowing arbitrary PHP code execution by including external files.
Description
Multiple PHP remote file inclusion vulnerabilities in OpenDock Easy Blog 1.4 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the doc_directory parameter in (1) down_stat.php, (2) file.php, (3) find_file.php, (4) lib_read_file.php, and (5) lib_form_file.php in sw/lib_up_file; (6) find_comment.php, (7) comment.php, and (8) lib_comment.php in sw/lib_comment/; (9) sw/lib_find/find.php; and other unspecified vectors.
Exploits (2)
This exploit demonstrates a remote file inclusion vulnerability in OpenDock Easy Doc <=1.4, where the 'doc_directory' parameter in multiple PHP scripts is not properly sanitized, allowing arbitrary PHP code execution by including external files.
This exploit demonstrates a remote file inclusion vulnerability in OpenDock Easy Blog <=1.4. The vulnerability allows arbitrary PHP code execution by manipulating the $doc_directory parameter in multiple scripts.