CVE-2006-6661

php-update < 2.7 - Remote Code Execution via Variable Overwrite in blog.php

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-6661. PoCs published by rgod.

AI-analyzed exploit summary This exploit leverages an `extract()` vulnerability in PHPUpdate <= 2.7 to bypass authentication and inject a PHP shell via a maliciously crafted POST request. It then executes arbitrary commands by retrieving the injected shell via a GET request with the `CLIENT-IP` header.

Description

Variable overwrite vulnerability in blog.php in PHP-Update 2.7 and earlier allows remote attackers to overwrite arbitrary program variables and execute arbitrary PHP code via multiple vectors that use the extract function, as demonstrated by the (1) f, (2) newmessage, (3) newusername, (4) adminuser, and (5) permission parameters.

Exploits (1)

exploitdb WORKING POC VERIFIED
by rgod · phpwebappsphp
https://www.exploit-db.com/exploits/2953

This exploit leverages an `extract()` vulnerability in PHPUpdate <= 2.7 to bypass authentication and inject a PHP shell via a maliciously crafted POST request. It then executes arbitrary commands by retrieving the injected shell via a GET request with the `CLIENT-IP` header.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: PHPUpdate <= 2.7
No auth needed
Prerequisites: Target must be running PHPUpdate <= 2.7 · Target must have the blog.php endpoint accessible
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/5088
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/2953
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/23407

Scores

EPSS 0.0628
EPSS Percentile 92.7%

Details

Status published
Products (1)
php-update/php-update < 2.7
Published Dec 20, 2006
Tracked Since Feb 18, 2026