Exploitation Summary
EIP tracks 1 public exploit for CVE-2006-6912. PoCs published by elgCrew.
AI-analyzed exploit summary This exploit leverages SQL injection in phpMyFAQ < 1.6.8 to upload a malicious PHP file via the attachment feature, achieving remote command execution. The payload is embedded in a crafted SQL query and uploaded to the server, then executed via a direct request.
Description
SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly the userfile or filename parameter.
Exploits (1)
This exploit leverages SQL injection in phpMyFAQ < 1.6.8 to upload a malicious PHP file via the attachment feature, achieving remote command execution. The payload is embedded in a crafted SQL query and uploaded to the server, then executed via a direct request.