CVE-2006-5306

phpbb journals_system_module < 1.0.2_rc2 - Remote Code Execution via phpbb_root_path Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-5306. PoCs published by Nima Salehi.

AI-analyzed exploit summary This exploit targets a remote file include vulnerability in Journals System <= 1.0.2 by injecting a remote shell script via the `phpbb_root_path` parameter. It establishes a TCP connection to the target and sends crafted HTTP requests to execute arbitrary commands.

Description

Multiple PHP remote file inclusion vulnerabilities in the Journals System module 1.0.2 (RC2) and earlier for phpBB allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) includes/journals_delete.php, (2) includes/journals_post.php, or (3) includes/journals_edit.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Nima Salehi · pythonwebappsphp

https://www.exploit-db.com/exploits/2522

View Code ZIP pw:eip

This exploit targets a remote file include vulnerability in Journals System <= 1.0.2 by injecting a remote shell script via the `phpbb_root_path` parameter. It establishes a TCP connection to the target and sends crafted HTTP requests to execute arbitrary commands.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Journals System <= 1.0.2

No auth needed

Prerequisites: Remote shell script hosted on attacker-controlled server · Network access to target web server

MITRE ATT&CK