CVE-2006-7052
DotWidget For Articles 0.2 - Remote File Inclusion via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 7 public exploits for CVE-2006-7052. PoCs published by SwEET-DeViL.
AI-analyzed exploit summary The provided text describes a remote file inclusion vulnerability in dotWidget for Articles, allowing arbitrary PHP code execution via unsanitized input in the 'file_path' parameter. It references a related vulnerability (BID 18258) but does not include functional exploit code.
Description
Multiple PHP remote file inclusion vulnerabilities in DotWidget For Articles (dotwidgeta) 0.2 allow remote attackers to execute arbitrary code via a URL in the (1) file_path parameter to (a) index.php, (b) showcatpicks.php, and (c) showarticle.php; and the (2) admin_header_file and (3) admin_footer_file parameters to (d) admin/authors.php, (e) admin/index.php, (f) admin/categories.php, (g) admin/editconfig.php, and (h) admin/articles.php.
Exploits (7)
The provided text describes a remote file inclusion vulnerability in dotWidget for Articles, allowing arbitrary PHP code execution via unsanitized input in the 'file_path' parameter. It references a related vulnerability (BID 18258) but does not include functional exploit code.
The provided text describes a remote file inclusion vulnerability in dotWidget for Articles, where unsanitized user input allows arbitrary remote file inclusion. No actual exploit code is present, only a description and example URL.
The provided text describes a remote file inclusion vulnerability in dotWidget for Articles, where unsanitized user input allows arbitrary PHP code execution via remote file inclusion. It references a specific example URL but lacks actual exploit code.
The provided text describes a remote file inclusion vulnerability in dotWidget for Articles, where unsanitized user input allows arbitrary PHP code execution via malicious file inclusion. It references specific attack vectors but lacks executable exploit code.
The provided text describes a remote file inclusion vulnerability in dotWidget for Articles, where unsanitized input allows arbitrary PHP code execution via malicious file inclusion. It references specific vulnerable parameters and related advisories.
The provided text describes a remote file inclusion vulnerability in dotWidget for Articles, where unsanitized input allows arbitrary remote file inclusion. It includes example URLs demonstrating the exploit but lacks executable code.
The provided text describes a remote file inclusion vulnerability in dotWidget for Articles, where unsanitized user input allows arbitrary remote file inclusion. The example URL demonstrates how an attacker could include a malicious PHP file (e.g., r57shell.txt) via the 'admin_footer_file' parameter.