CVE-2006-5768

cyberfolio < 2.0_rc1 - Remote File Inclusion via av Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-5768. PoCs published by the_day.

AI-analyzed exploit summary This is an advisory detailing a remote file inclusion vulnerability in Cyberfolio <=2.0 RC1. The vulnerability allows arbitrary PHP code execution by manipulating the '$av' parameter in multiple scripts.

Description

Multiple PHP remote file inclusion vulnerabilities in Cyberfolio 2.0 RC1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the av parameter to (1) msg/view.php, (2) msg/inc_message.php, (3) msg/inc_envoi.php, and (4) admin/incl_voir_compet.php.

Exploits (1)

exploitdb WRITEUP VERIFIED

by the_day · textwebappsphp

https://www.exploit-db.com/exploits/2725

View Code ZIP pw:eip

This is an advisory detailing a remote file inclusion vulnerability in Cyberfolio <=2.0 RC1. The vulnerability allows arbitrary PHP code execution by manipulating the '$av' parameter in multiple scripts.

Classification

Writeup 100%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Cyberfolio <=2.0 RC1

No auth needed

Prerequisites: Network access to the target application · Ability to host a malicious PHP file on an external server

MITRE ATT&CK