CVE-2006-5390

phpBB ACP User Registration Module - Remote Code Execution via phpbb_root_path Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-5390. PoCs published by bd0rk.

AI-analyzed exploit summary This exploit demonstrates a file inclusion vulnerability in phpBB ACP User Registration (MMW) Mod 1.00. The vulnerability allows remote attackers to include arbitrary files via the `phpbb_root_path` parameter in `functions_mod_user.php`.

Description

PHP remote file inclusion vulnerability in includes/functions_mod_user.php in the ACP User Registration (MMW) 1.00 module for phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by bd0rk · textwebappsphp

https://www.exploit-db.com/exploits/2551

View Code ZIP pw:eip

This exploit demonstrates a file inclusion vulnerability in phpBB ACP User Registration (MMW) Mod 1.00. The vulnerability allows remote attackers to include arbitrary files via the `phpbb_root_path` parameter in `functions_mod_user.php`.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: phpBB ACP User Registration (MMW) Mod 1.00

No auth needed

Prerequisites: Access to the target URL · The vulnerable mod must be installed

MITRE ATT&CK