CVE-2006-6417
b2evolution 1.8.5-1.9 beta - Remote File Inclusion via inc_path Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-6417. PoCs published by tarkus.
AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in b2evolution due to improper input validation in import-mt.php. By manipulating the inc_path parameter, an attacker can include remote files if register_globals and allow_url_fopen are enabled.
Description
PHP remote file inclusion vulnerability in inc/CONTROL/import/import-mt.php in b2evolution 1.8.5 through 1.9 beta allows remote attackers to execute arbitrary PHP code via a URL in the inc_path parameter.
Exploits (1)
This exploit demonstrates a remote file inclusion vulnerability in b2evolution due to improper input validation in import-mt.php. By manipulating the inc_path parameter, an attacker can include remote files if register_globals and allow_url_fopen are enabled.