CVE-2006-0144

CVE-2006-0144 describes a critical vulnerability in the go-pear.php proxy server feature within PHP PEAR 0.2.2, specifically as integrated into Apache2Triad. This flaw allows unauthenticated remote attackers to execute arbitrary PHP code. Attackers can achieve this by redirecting go-pear.php to a malicious proxy, which then serves a modified Tar.php file containing a malicious extractModify function. The vulnerability carries a CVSS score of 7.5 (High), indicating a severe risk. It is easily exploitable over the network with low attack complexity and requires no authentication, potentially leading to complete compromise of confidentiality, integrity, and availability. Despite its age and severity, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention.