CVE-2006-0957

CVE-2006-0957 describes a direct static code injection vulnerability in func.inc.php within ZoneO-Soft freeForum versions prior to 1.2.1. This flaw allows remote attackers to execute arbitrary PHP code by injecting malicious data into the X-Forwarded-For and Client-IP HTTP headers, which are then stored in the Data/flood.db.php file. With a CVSS score of 7.5, this vulnerability is considered highly severe due to its network-based attack vector, low attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been identified, the vulnerability remains a critical concern for unpatched freeForum installations.