CVE-2006-5497
Segue CMS < 1.5.7 - Remote File Inclusion via themesdir Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-5497. PoCs published by nuffsaid.
AI-analyzed exploit summary This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in Segue CMS <= 1.5.8 due to improper initialization of the $themesdir variable. By manipulating the query string, an attacker can include and execute arbitrary remote PHP files, leading to remote code execution.
Description
PHP remote file inclusion vulnerability in themes/program/themesettings.inc.php in Segue CMS 1.5.8 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter.
Exploits (1)
This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in Segue CMS <= 1.5.8 due to improper initialization of the $themesdir variable. By manipulating the query string, an attacker can include and execute arbitrary remote PHP files, leading to remote code execution.