CVE-2006-5832
AIOCP <= 1.3.007 - Information Disclosure via Error Message Path Leak
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2006-5832. PoCs published by laurent gaffie.
AI-analyzed exploit summary This exploit demonstrates multiple vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and prior, including XSS, SQL injection, remote file inclusion, and full path disclosure. The PoC provides specific URLs with malicious payloads to exploit these issues.
Description
All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to obtain the full path of the web server via certain requests to (1) public/code/cp_dpage.php, possibly involving the aiocp_dp[] parameter, (2) public/code/cp_show_ec_products.php, possibly involving the order_field[] parameter, and (3) public/code/cp_show_page_help.php, possibly involving the hp[] parameter, which reveal the path in various error messages.
Exploits (3)
This exploit demonstrates multiple vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and prior, including XSS, SQL injection, remote file inclusion, and full path disclosure. The PoC provides specific URLs with malicious payloads to exploit these issues.
The provided text describes an input-validation vulnerability in All In One Control Panel (AIOCP) versions 1.3.007 and prior, which could lead to XSS or other attacks. The example URL demonstrates a potential vector but lacks executable exploit code.
The provided text describes an input-validation vulnerability in All In One Control Panel (AIOCP) versions 1.3.007 and prior, which could lead to various attacks such as XSS or cookie theft. The example URL demonstrates a potential vector but lacks executable exploit code.