CVE-2006-7135

PHP Poll Creator 1.04 - Remote File Inclusion via relativer_pfad Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-7135. PoCs published by ThE-WoLf-KsA.

AI-analyzed exploit summary This exploit targets a remote file include vulnerability in phpPC <= 1.03 RC1 by injecting a malicious URL into the 'relativer_pfad' parameter. It uses a GUI to facilitate the attack and executes arbitrary commands via the included shell.

Description

PHP remote file inclusion vulnerability in lib/functions.inc.php in PHP Poll Creator (phpPC) 1.04 allows remote attackers to execute arbitrary PHP code via a URL in the relativer_pfad parameter, a different vector and version than CVE-2005-1755. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Exploits (1)

exploitdb WORKING POC VERIFIED

by ThE-WoLf-KsA · perlwebappsphp

https://www.exploit-db.com/exploits/2491

View Code ZIP pw:eip

This exploit targets a remote file include vulnerability in phpPC <= 1.03 RC1 by injecting a malicious URL into the 'relativer_pfad' parameter. It uses a GUI to facilitate the attack and executes arbitrary commands via the included shell.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: phpPC <= 1.03 RC1

No auth needed

Prerequisites: Target must have phpPC <= 1.03 RC1 installed · Remote file inclusion must be enabled on the server · Attacker must have a hosted shell script

MITRE ATT&CK

T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →