CVE-2007-6485

Centreon 1.4.1 - Remote Code Execution via FileOreonConf Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-6485. PoCs published by Michael Brooks.

AI-analyzed exploit summary This is a writeup describing a remote file inclusion (RFI) vulnerability in Oreon and Centreon versions 1.4 and 1.4.1. The vulnerability allows an attacker to include arbitrary remote files via the 'fileOreonConf' parameter in specific PHP scripts.

Description

Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute arbitrary PHP code via a URL in the fileOreonConf parameter to (1) MakeXML.php or (2) MakeXML4statusCounter.php in include/monitoring/engine/.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Michael Brooks · textwebappsphp

https://www.exploit-db.com/exploits/4735

View Code ZIP pw:eip

This is a writeup describing a remote file inclusion (RFI) vulnerability in Oreon and Centreon versions 1.4 and 1.4.1. The vulnerability allows an attacker to include arbitrary remote files via the 'fileOreonConf' parameter in specific PHP scripts.

Classification

Writeup 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Oreon 1.4, Centreon 1.4.1

No auth needed

Prerequisites: Network access to the target application · Ability to host a malicious file on a remote server

MITRE ATT&CK