CVE-2006-1085

CVE-2006-1085 describes an authentication bypass vulnerability in PHP-Stats version 0.1.9.1 and earlier, allowing remote attackers to gain administrator privileges. By manipulating the 'option[admin_pass]' parameter and setting the 'pass_cookie' to the MD5 hash of a chosen password, an attacker can execute arbitrary PHP code. This vulnerability carries a critical CVSS score of 10.0 due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.