CVE-2006-5763
Free File Hosting < 1.1 - Remote File Inclusion via AD_BODY_TEMP Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2006-5763. PoCs published by Crackers_Child, IbnuSina.
AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in Free Image Hosting 2.0, allowing an attacker to include arbitrary files via the 'AD_BODY_TEMP' parameter in multiple PHP scripts. The exploit provides clear examples of malicious URLs to trigger the vulnerability.
Description
Multiple PHP remote file inclusion vulnerabilities in Free File Hosting 1.1, and possibly earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter to (1) login.php, (2) register.php, or (3) send.php. NOTE: the original provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue was later reported for the "File Upload System" which is a component of Free File Hosting. Vector 1 also affects Free Image Hosting 2.0, which contains the same code.
Exploits (3)
This exploit demonstrates a remote file inclusion vulnerability in Free Image Hosting 2.0, allowing an attacker to include arbitrary files via the 'AD_BODY_TEMP' parameter in multiple PHP scripts. The exploit provides clear examples of malicious URLs to trigger the vulnerability.
The provided text describes a remote file inclusion vulnerability in Free File Hosting version 1.1, where insufficient sanitization of user-supplied data allows an attacker to include remote files. The example URL demonstrates the exploitation vector via the 'AD_BODY_TEMP' parameter.
The code describes a remote file inclusion vulnerability in Free File Hosting version 1.1, where insufficient sanitization of user-supplied data allows an attacker to include remote files via the 'AD_BODY_TEMP' parameter in login.php. This is related to a previously reported issue (BID 20781).