CVE-2006-0785

CVE-2006-0785 describes an absolute path traversal vulnerability in PHPKIT 1.6.1 Release 2 and earlier, allowing remote attackers to include and execute arbitrary local files. This flaw occurs due to insufficient validation of the 'path' parameter in include.php, which can be bypassed using null characters and absolute pathnames (e.g., '/' or drive letters) to circumvent checks for directory traversal sequences and file extensions. The vulnerability has a CVSS score of 6.4, indicating a medium severity. It is easily exploitable over the network with low attack complexity and no authentication required, potentially leading to information disclosure and arbitrary code execution. There is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention.