Exploitation Summary
EIP tracks 2 public exploits for CVE-2006-5291. PoCs published by v1per-haCker, Kw3[R]Ln.
AI-analyzed exploit summary This exploit demonstrates a Remote File Include (RFI) vulnerability in Download-Engine 1.4.2. The vulnerability allows an attacker to include and execute arbitrary remote files by manipulating the 'spaw_root' parameter in the 'spaw_control.class.php' script.
Description
PHP remote file inclusion vulnerability in admin/includes/spaw/spaw_control.class.php in Download-Engine 1.4.2 allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter. NOTE: CVE analysis suggests that this issue is actually in a third party product, SPAW Editor PHP Edition, so this issue is probably a duplicate of CVE-2006-4656.
Exploits (2)
This exploit demonstrates a Remote File Include (RFI) vulnerability in Download-Engine 1.4.2. The vulnerability allows an attacker to include and execute arbitrary remote files by manipulating the 'spaw_root' parameter in the 'spaw_control.class.php' script.
The exploit describes a remote file inclusion vulnerability in SL_Site <= 1.0 due to an unsanitized $spaw_root variable when register_globals is enabled. The attacker can inject a malicious script via the spaw_root parameter in the spaw_control.class.php file.