Description
Multiple PHP remote file inclusion vulnerabilities in QnECMS 2.5.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the adminfolderpath parameter to (1) headerscripts.php, (2) footerhome.php, and (3) footermain.php in admin/include/; (4) photogallery/headerscripts.php; and (5) footerhome.php, (6) footermain.php, (7) headermain.php, (8) sitemapfooter.php, and (9) sitemapheader.php in templates/.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- QnECMS 2.5.6 - 'adminfolderpath' Remote File Inclusion EDB-2681 · webapps · Oct 30, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 22623 third-party-advisory
- 30124 vdb-entry
- 30122 vdb-entry
- 20801 vdb-entry
- ADV-2006-4258 vdb-entry
- qnecms-adminfolderpath-file-include(29871) vdb-entry
- 30121 vdb-entry
- 20061030 [ECHO_ADV_53$2006] QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Vulnerability mailing-list
- 30117 vdb-entry
- 30123 vdb-entry
- 2681 exploit
- 20061122 Re: [ECHO_ADV_53$2006] QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Vulnerability mailing-list
- 30119 vdb-entry
- 30125 vdb-entry
- 30118 vdb-entry
- 30120 vdb-entry
- http://advisories.echo.or.id/adv/adv53-K-159-2006.txt