CVE-2006-6552

BLOG:CMS <= 4.1.3 - Remote File Inclusion via DIR_ADMIN Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-6552. PoCs published by HACKERS PAL.

AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in BLOG:CMS by manipulating the DIR_ADMIN parameter to include a remote file. The attack leverages improper input validation to execute arbitrary code.

Description

PHP remote file inclusion vulnerability in admin/plugins/NP_UserSharing.php in BLOG:CMS 4.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DIR_ADMIN parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by HACKERS PAL · textwebappsphp

https://www.exploit-db.com/exploits/2923

View Code ZIP pw:eip

This exploit demonstrates a remote file inclusion vulnerability in BLOG:CMS by manipulating the DIR_ADMIN parameter to include a remote file. The attack leverages improper input validation to execute arbitrary code.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: BLOG:CMS (version unspecified)

No auth needed

Prerequisites: Remote file inclusion must be enabled on the target server · Attacker-controlled remote file with malicious code

MITRE ATT&CK