CVE-2006-2315

CVE-2006-2315 describes a remote file inclusion vulnerability in ISPConfig 2.2.2 and earlier, specifically within the session.inc.php file. Attackers could exploit this by injecting a malicious URL into the go_info[server][classes_root] parameter, leading to arbitrary PHP code execution. This vulnerability carries a high CVSS score of 7.5, indicating a network-based attack with low complexity, allowing for partial confidentiality, integrity, and availability compromise. While the vendor disputed the vulnerability's applicability to version 2.2 under specific configurations, exploit code is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.