CVE-2006-6544

CM68 News - Cross-Site Scripting

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-6544. PoCs published by Paul Bakoyiannis.

AI-analyzed exploit summary The exploit demonstrates a file inclusion vulnerability in cm68news via the 'addpath' parameter in /engine/oldnews.inc.php. By manipulating the parameter, an attacker can include remote files, leading to potential remote code execution.

Description

Cross-site scripting (XSS) vulnerability in CM68 News allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Paul Bakoyiannis · textwebappsphp

https://www.exploit-db.com/exploits/2897

View Code ZIP pw:eip

The exploit demonstrates a file inclusion vulnerability in cm68news via the 'addpath' parameter in /engine/oldnews.inc.php. By manipulating the parameter, an attacker can include remote files, leading to potential remote code execution.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: cm68news

No auth needed

Prerequisites: Access to the vulnerable endpoint · Remote file hosting for malicious payload

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Core References

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/4911

Patch x_refsource_misc

http://cm68.de/?cm68news_download

Scores

EPSS 0.0042

EPSS Percentile 62.5%

Details

Status published

Products (1)

cm68_news/cm68_news

Published Dec 14, 2006

Tracked Since Feb 18, 2026