CVE-2006-4674

CVE-2006-4674 describes a direct static code injection vulnerability in DokuWiki versions prior to 2006-030-09c, specifically within the doku.php file. This flaw allows remote attackers to execute arbitrary PHP code by manipulating the X-FORWARDED-FOR HTTP header, which is then improperly stored in the config.php file. The vulnerability carries a CVSS score of 7.5, indicating high severity with a network attack vector, low access complexity, and no authentication required, leading to potential partial confidentiality, integrity, and availability impacts. Its FAUCET Risk Score is 54/100. Despite its severity, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a lack of widespread attention or exploitation.