CVE-2008-6099
RPortal < 1.1 - Remote Code Execution via File Op Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-6099. PoCs published by Kad.
AI-analyzed exploit summary This exploit demonstrates a remote and local file inclusion vulnerability in RPortal v1.1 due to improper filtering of the $file_op parameter, allowing arbitrary file inclusion and potential remote code execution.
Description
PHP remote file inclusion vulnerability in index.php in RPortal 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the file_op parameter.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Kad · textwebappsphp
https://www.exploit-db.com/exploits/6648
This exploit demonstrates a remote and local file inclusion vulnerability in RPortal v1.1 due to improper filtering of the $file_op parameter, allowing arbitrary file inclusion and potential remote code execution.
Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target:
RPortal v1.1
No auth needed
Prerequisites:
Access to the vulnerable web application
mistral-large-3 · analyzed Feb 16, 2026
Full analysis →
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/31523
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/45618
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/6648
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32075
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/496891/100/0/threaded
Scores
EPSS
0.0265
EPSS Percentile
83.8%
Details
CWE
CWE-94
Status
published
Products (1)
rportal/rportal
< 1.1
Published
Feb 10, 2009
Tracked Since
Feb 18, 2026