CVE-2006-5256

Claroline < 1.8.0 - Remote File Inclusion via includePath Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-5256. PoCs published by k1tk4t.

AI-analyzed exploit summary This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in Claroline <= 1.8.0rc1. The vulnerability allows an attacker to include arbitrary remote files via the `includePath` parameter in `import.lib.php`.

Description

PHP remote file inclusion vulnerability in claroline/inc/lib/import.lib.php in Claroline 1.8.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the includePath parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by k1tk4t · textwebappsphp

https://www.exploit-db.com/exploits/2510

View Code ZIP pw:eip

This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in Claroline <= 1.8.0rc1. The vulnerability allows an attacker to include arbitrary remote files via the `includePath` parameter in `import.lib.php`.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Claroline <= 1.8.0rc1

No auth needed

Prerequisites: Network access to the target application · Remote file hosting with malicious payload

MITRE ATT&CK