CVE-2006-5314

TribunaLibre 3.12 Beta - Remote File Inclusion via mostrar Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-5314. PoCs published by DarkFig.

AI-analyzed exploit summary This is a writeup describing a file inclusion vulnerability in TribunaLibre v3.12 Beta, where the 'mostrar' parameter in ftag.php is used to include arbitrary files. The vulnerability allows for source disclosure or remote file inclusion attacks.

Description

PHP remote file inclusion vulnerability in ftag.php in TribunaLibre 3.12 Beta allows remote attackers to execute arbitrary PHP code via a URL in the mostrar parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by DarkFig · textwebappsphp

https://www.exploit-db.com/exploits/2501

View Code ZIP pw:eip

This is a writeup describing a file inclusion vulnerability in TribunaLibre v3.12 Beta, where the 'mostrar' parameter in ftag.php is used to include arbitrary files. The vulnerability allows for source disclosure or remote file inclusion attacks.

Classification

Writeup 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: TribunaLibre v3.12 Beta

No auth needed

Prerequisites: Access to the vulnerable ftag.php script

MITRE ATT&CK