cve/2006/CVE-2006-6694.md

CVE-2006-6694

Description

Directory traversal vulnerability in include/config.php in E-Uploader Pro 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a .. (dot dot) in the language parameter, as demonstrated by uploading a .JPG file containing PHP code, then accessing the file via config.php.

POC

Reference

• https://www.exploit-db.com/exploits/2556
• https://www.exploit-db.com/exploits/2556

Github

No PoCs found on GitHub currently.