CVE-2010-1272

gnat-tgp < 1.2.20 - Remote Code Execution via DOCUMENT_ROOT Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-1272. PoCs published by cr4wl3r.

AI-analyzed exploit summary This is a writeup describing a Remote File Include (RFI) vulnerability in Gnat-TGP <= 1.2.20. The PoC demonstrates how an attacker can include a remote shell by manipulating the DOCUMENT_ROOT parameter in tgpinc.php.

Description

PHP remote file inclusion vulnerability in includes/tgpinc.php in Gnat-TGP 1.2.20 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.

Exploits (1)

exploitdb WRITEUP

by cr4wl3r · textwebappsphp

https://www.exploit-db.com/exploits/11621

View Code ZIP pw:eip

This is a writeup describing a Remote File Include (RFI) vulnerability in Gnat-TGP <= 1.2.20. The PoC demonstrates how an attacker can include a remote shell by manipulating the DOCUMENT_ROOT parameter in tgpinc.php.

Classification

Writeup 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Theoretical

Target: Gnat-TGP <= 1.2.20

No auth needed

Prerequisites: Remote file inclusion must be enabled on the target server · Attacker must be able to host a malicious shell or file on a remote server

MITRE ATT&CK

T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →