CVE-2006-7117
Kubix < 0.7 - Path Traversal via Theme Cookie or File Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2006-7117. PoCs published by BlackHawk.
AI-analyzed exploit summary This exploit demonstrates multiple vulnerabilities in Kubix CMS <=0.7, including Local File Inclusion (LFI), SQL Injection for login bypass, and arbitrary file download via path traversal. It provides functional proof-of-concept code for each attack vector.
Description
Multiple directory traversal vulnerabilities in Kubix 0.7 and earlier allow remote attackers to (1) include and execute arbitrary local files via ".." sequences in the theme cookie to index.php, which is not properly handled by includes/head.php; and (2) read arbitrary files via ".." sequences in the file parameter in an add_dl action to adm_index.php, as demonstrated by reading connect.php.
Exploits (1)
This exploit demonstrates multiple vulnerabilities in Kubix CMS <=0.7, including Local File Inclusion (LFI), SQL Injection for login bypass, and arbitrary file download via path traversal. It provides functional proof-of-concept code for each attack vector.