CVE-2006-6966

CVE-2006-6966 describes a vulnerability in phpGraphy versions prior to 0.9.13a, where improper variable handling could allow remote attackers to execute arbitrary PHP code. This occurs when input data contains a numeric parameter matching an alphanumeric parameter's hash, enabling the upload of a malicious config.php file via the pictures[] parameter to index.php. The vulnerability carries a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low complexity, and potential for complete compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, an ExploitDB entry (EDB-2867) exists, suggesting public exploit code for privilege escalation and command execution, despite minimal community discussion or media coverage.