CVE-2006-5554
Imageview < 5 - Directory Traversal via User Settings Cookie
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-5554. PoCs published by Kacper.
AI-analyzed exploit summary This exploit targets a remote code execution vulnerability in Imageview 5 by uploading a malicious GIF file via a multipart form and then triggering its inclusion via a manipulated cookie. The payload executes arbitrary commands through the 'HAURU' header.
Description
Directory traversal vulnerability in index.php in Imageview 5 allows remote attackers to read or execute arbitrary local files via a .. (dot dot) in the user_settings cookie, as demonstrated by using the MyFile parameter in albumview.php to upload a text/plain .gif file containing PHP code, which is executed by index.php.
Exploits (1)
This exploit targets a remote code execution vulnerability in Imageview 5 by uploading a malicious GIF file via a multipart form and then triggering its inclusion via a manipulated cookie. The payload executes arbitrary commands through the 'HAURU' header.