CVE-2006-7127
JAF CMS 4.0 and 4.0 RC2 - Remote Code Execution via main_dir Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-7127. PoCs published by CraCkEr, ThE TiGeR.
AI-analyzed exploit summary This exploit demonstrates a Remote File Include (RFI) vulnerability in JAF-CMS 4.0 RC2. It provides URLs that can be used to include arbitrary remote files by manipulating the 'website' or 'main_dir' parameters.
Description
Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the main_dir parameter to (1) forum/main.php and (2) forum/headlines.php.
Exploits (2)
This exploit demonstrates a Remote File Include (RFI) vulnerability in JAF-CMS 4.0 RC2. It provides URLs that can be used to include arbitrary remote files by manipulating the 'website' or 'main_dir' parameters.
This exploit demonstrates a remote file inclusion vulnerability in JAF CMS 4.0 by manipulating the 'main_dir' parameter to include arbitrary remote files. The vulnerable code does not properly sanitize user input, allowing an attacker to inject malicious URLs.