CVE-2006-6154

HIOX Star Rating System Script <1.0 - RCE

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-6154. PoCs published by Cold Zero.

AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in HSRS <= 1.0 (HIOX Star Rating System Script) via the 'addcode.php' file. The vulnerability allows an attacker to include arbitrary remote files by manipulating the 'hm' parameter.

Description

PHP remote file inclusion vulnerability in addcode.php in HIOX Star Rating System Script (HSRS) 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the hm parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Cold Zero · textwebappsphp

https://www.exploit-db.com/exploits/2838

View Code ZIP pw:eip

This exploit demonstrates a remote file inclusion vulnerability in HSRS <= 1.0 (HIOX Star Rating System Script) via the 'addcode.php' file. The vulnerability allows an attacker to include arbitrary remote files by manipulating the 'hm' parameter.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: HSRS (HIOX Star Rating System Script) <= 1.0

No auth needed

Prerequisites: PHP remote file inclusion enabled on the target server · Network access to the target application

MITRE ATT&CK