CVE-2006-2578

CVE-2006-2578 is a critical file inclusion vulnerability affecting eSyndicat Directory 1.2. When specific PHP configurations (register_globals enabled, magic_quotes_gpc disabled) are present, remote attackers can exploit this flaw by manipulating the 'path_to_config' parameter with a null-terminated value. This allows for the inclusion of arbitrary files, potentially leading to remote code execution. The vulnerability has a CVSS score of 5.1, indicating a medium severity. Its attack vector is network-based, but exploitation requires high attack complexity due to the specific PHP configuration prerequisites. Successful exploitation could result in partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, nor is exploit code publicly available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention.