CVE-2006-0852

CVE-2006-0852 describes a direct static code injection vulnerability in Admbook version 1.2.2 and earlier, specifically within the write.php component. This flaw allows unauthenticated remote attackers to execute arbitrary PHP code by manipulating the X-Forwarded-For HTTP header, which is then written into content-data.php. The vulnerability carries a CVSS score of 7.5 (High), indicating a network-based attack with low complexity and no authentication required, potentially leading to full compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog or having Metasploit/Nuclei modules, an exploit (EDB-1512) is publicly available, though there is minimal community discussion or media coverage surrounding this older vulnerability.