CVE-2007-5185

phpwcms-xt < 0.0.7_beta - Remote Code Execution via HTML_MENU_DirPath Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-5185. PoCs published by kezzap66345.

AI-analyzed exploit summary This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in php WCMS XT 0.0.7 BETA. The vulnerability allows an attacker to include arbitrary remote files via the `HTML_MENU_DirPath` parameter in two specific PHP scripts.

Description

Multiple PHP remote file inclusion vulnerabilities in phpWCMS XT 0.0.7 BETA and earlier allow remote attackers to execute arbitrary PHP code via a URL in the HTML_MENU_DirPath parameter to (1) config_HTML_MENU.php and (2) config_PHPLM.php in phpwcms_template/inc_script/frontend_render/navigation/.

Exploits (1)

exploitdb WORKING POC VERIFIED

by kezzap66345 · textwebappsphp

https://www.exploit-db.com/exploits/4477

View Code ZIP pw:eip

This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in php WCMS XT 0.0.7 BETA. The vulnerability allows an attacker to include arbitrary remote files via the `HTML_MENU_DirPath` parameter in two specific PHP scripts.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: php WCMS XT 0.0.7 BETA

No auth needed

Prerequisites: Network access to the target web application · PHP remote file inclusion enabled on the target server

MITRE ATT&CK