Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-104626. PoCs published by Calum Hutton.
AI-analyzed exploit summary The writeup details an unauthenticated RCE vulnerability in Clickheat 1.13+ due to unsanitized input in the `parseClickLogs.pl` script, allowing command injection via pipe symbols in the `srcFile` parameter. The exploit leverages Perl's `open()` function to execute arbitrary commands when the script is accessed via a URL.
Description
ClickHeat 1.13+ - Remote Command Execution
Exploits (1)
The writeup details an unauthenticated RCE vulnerability in Clickheat 1.13+ due to unsanitized input in the `parseClickLogs.pl` script, allowing command injection via pipe symbols in the `srcFile` parameter. The exploit leverages Perl's `open()` function to execute arbitrary commands when the script is accessed via a URL.