Exploit

EDB-ID: 28874	Author: Cyber Security	Published: 2006-10-30
CVE: CVE-2006-7184	Type: Webapps	Platform: PHP
Aliases: N/A	Advisory/Source: Link	Tags: N/A
E-DB Verified:	Exploit: Download / View Raw	Vulnerable App: N/A

« Previous Exploit Next Exploit »

source: http://www.securityfocus.com/bid/20793/info
 
Exhibit Engine Software is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
 
Version 1.22 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/fstyles.php?toroot=shell

Related Exploits

Trying to match CVEs (1): CVE-2006-7184
Trying to match OSVDBs (1): 33999
Other Possible E-DB Search Terms: Exhibit Engine 1.22, Exhibit Engine

Date	Title	Author
2006-11-25	Exhibit Engine 1.22 - 'styles.php' Remote File Inclusion	Kacper
2006-10-30	Exhibit Engine 1.22 - fetchsettings.php toroot Parameter Remote File Inclusion	Cyber Security
2006-10-10	Exhibit Engine 1.5 RC 4 - 'photo_comment.php' File Inclusion	Kacper

Exhibit Engine 1.22 - fstyles.php toroot Parameter Remote File Inclusion

Related Exploits