CVE-2006-6976

CentiPaid < 1.4.2 - Remote Code Execution via absolute_path Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-6976. PoCs published by Kw3[R]Ln.

AI-analyzed exploit summary The exploit describes a remote file inclusion vulnerability in CentiPaid <= 1.4.2 due to an unsanitized $absolute_path variable when register_globals is enabled. It provides a URL-based proof-of-concept for exploitation.

Description

PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.2 and earlier allows remote attackers to execute arbitrary code via a URL in the absolute_path parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Kw3[R]Ln · textwebappsphp

https://www.exploit-db.com/exploits/2555

View Code ZIP pw:eip

The exploit describes a remote file inclusion vulnerability in CentiPaid <= 1.4.2 due to an unsanitized $absolute_path variable when register_globals is enabled. It provides a URL-based proof-of-concept for exploitation.

Classification

Writeup 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: CentiPaid <= 1.4.2

No auth needed

Prerequisites: register_globals=on · remote file inclusion enabled

MITRE ATT&CK

T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Core References

Exploit mailing-list x_refsource_vim

http://www.attrition.org/pipermail/vim/2007-February/001296.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/29564

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/2555

Scores

EPSS 0.0412

EPSS Percentile 89.5%

Details

CWE

CWE-94

Status published

Products (1)

centipaid/centipaid < 1.4.2

Published Feb 08, 2007

Tracked Since Feb 18, 2026