CVE-2006-6042
phpwebthings < 1.5.2 - Remote File Inclusion via editor_insert_bottom Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-6042. PoCs published by nuffsaid.
AI-analyzed exploit summary This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in phpWebThings 1.5.2 due to improper initialization of the $editor_insert_bottom variable in core/editor.php. By manipulating the query string, an attacker can include and execute a remote PHP file, leading to arbitrary code execution.
Description
PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the editor_insert_bottom parameter.
Exploits (1)
This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in phpWebThings 1.5.2 due to improper initialization of the $editor_insert_bottom variable in core/editor.php. By manipulating the query string, an attacker can include and execute a remote PHP file, leading to arbitrary code execution.