CVE-2006-5733

PostNuke < 0.763 - Directory Traversal and Arbitrary File Execution via PNSVlang Cookie

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-5733. PoCs published by Kacper.

AI-analyzed exploit summary This exploit leverages a local file inclusion vulnerability in PostNuke <= 0.763 by manipulating the 'lang' session variable to include arbitrary files, leading to remote code execution via log poisoning.

Description

Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Kacper · phpwebappsphp

https://www.exploit-db.com/exploits/2707

View Code ZIP pw:eip

This exploit leverages a local file inclusion vulnerability in PostNuke <= 0.763 by manipulating the 'lang' session variable to include arbitrary files, leading to remote code execution via log poisoning.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: PostNuke <= 0.763

Auth required

Prerequisites: Valid session ID · Access to inject malicious code into log files

MITRE ATT&CK