CVE-2006-5716

FreeNews 2.1 - Directory Traversal via chemin Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-5716. PoCs published by MoHaNdKo.

AI-analyzed exploit summary The provided text describes a remote file inclusion vulnerability in Freenews, where the 'chemin' parameter in 'aff_news.php' is not properly sanitized. This allows an attacker to include arbitrary files, potentially leading to remote code execution.

Description

Directory traversal vulnerability in aff_news.php in FreeNews 2.1 allows remote attackers to include local files via a .. (dot dot) sequence in the chemin parameter, when the aff_news parameter is not set to "1."

Exploits (1)

exploitdb WRITEUP VERIFIED

by MoHaNdKo · textwebappsphp

https://www.exploit-db.com/exploits/28875

View Code ZIP pw:eip

The provided text describes a remote file inclusion vulnerability in Freenews, where the 'chemin' parameter in 'aff_news.php' is not properly sanitized. This allows an attacker to include arbitrary files, potentially leading to remote code execution.

Classification

Writeup 80%

Attack Type

Rce

Complexity

Trivial

Reliability

Theoretical

Target: Freenews (version not specified)

No auth needed

Prerequisites: Access to the vulnerable 'aff_news.php' endpoint · Ability to craft a malicious URL with a remote or local file inclusion payload

MITRE ATT&CK