CVE-2006-7063

tinyphpforum < 3.6 - Directory Traversal and Arbitrary File Execution via Profile UName Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-7063. PoCs published by Hessam-x.

AI-analyzed exploit summary This exploit targets a path traversal and PHP code injection vulnerability in TinyPHP forum <= 3.6. It injects malicious PHP code into Apache log files via HTTP headers and then executes arbitrary commands by including the log file through the vulnerable profile.php script.

Description

Directory traversal vulnerability in profile.php in TinyPHPforum 3.6 and earlier allows remote attackers to include and execute arbitrary files via ".." sequences in the uname parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Hessam-x · perlwebappsphp

https://www.exploit-db.com/exploits/1857

View Code ZIP pw:eip

This exploit targets a path traversal and PHP code injection vulnerability in TinyPHP forum <= 3.6. It injects malicious PHP code into Apache log files via HTTP headers and then executes arbitrary commands by including the log file through the vulnerable profile.php script.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: TinyPHP forum <= 3.6

No auth needed

Prerequisites: Target must be running TinyPHP forum <= 3.6 · Apache log files must be writable and accessible via path traversal · Target must allow outbound connections to attacker

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →