CVE-2006-3184

CVE-2006-3184 describes a direct static code injection vulnerability affecting ASP Stats Generator versions prior to 2.1.2. An authenticated attacker can exploit this by injecting arbitrary ASP code through the strAsgSknPageBgColour parameter in settings_skin.asp, which is then stored and executed via inc_skin_file.asp. This vulnerability has a CVSS score of 4.0, indicating a medium severity. It requires authentication (Au:S) but has low attack complexity (AC:L) and can lead to partial integrity impact (I:P) by allowing code execution, though confidentiality and availability are not directly affected. There is no evidence of active exploitation, and no Metasploit or Nuclei modules exist. While an ExploitDB entry for SQL injection in a similar product version exists, it does not directly address this code injection. Community discussion and media coverage are minimal, suggesting low public attention.