CVE-2006-6151

Messagerie Locale - Remote File Inclusion via centre.php page Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-6151. PoCs published by DaDIsS.

AI-analyzed exploit summary This is a writeup describing a Remote File Inclusion (RFI) vulnerability in Messagerie Locale's centre.php. The exploit explanation details how the $page parameter is improperly sanitized, allowing remote file inclusion via URL manipulation.

Description

PHP remote file inclusion vulnerability in centre.php in Messagerie Locale as of 20061127 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Exploits (1)

exploitdb WRITEUP VERIFIED

by DaDIsS · textwebappsphp

https://www.exploit-db.com/exploits/2832

View Code ZIP pw:eip

This is a writeup describing a Remote File Inclusion (RFI) vulnerability in Messagerie Locale's centre.php. The exploit explanation details how the $page parameter is improperly sanitized, allowing remote file inclusion via URL manipulation.

Classification

Writeup 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Messagerie Locale (version unspecified)

No auth needed

Prerequisites: Target must have allow_url_include enabled in PHP configuration · Attacker must be able to host a malicious PHP file on a remote server

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →