CVE-2006-1784

CVE-2006-1784 describes a remote file inclusion vulnerability in Sphider 1.3 and earlier, specifically within the admin/configset.php file, when the register_globals setting is disabled. An attacker could exploit this by injecting a malicious URL into the settings_dir parameter, leading to the execution of arbitrary PHP code on the affected server. This vulnerability has a CVSS score of 5.1, indicating a medium severity with a network attack vector and high attack complexity, but with potential for partial confidentiality, integrity, and availability impact. While not listed in CISA's KEV catalog, public exploit code exists on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.