CVE-2006-1087

CVE-2006-1087 is a direct static code injection vulnerability affecting PHP-Stats versions 0.1.9.1 and earlier. It allows remote authenticated administrators to execute arbitrary PHP code by injecting malicious input into the option_new[compatibility_mode] parameter, which is then stored unfiltered in config.php. This vulnerability has a CVSS score of 6.5, indicating a medium severity with low attack complexity and potential for partial compromise of confidentiality, integrity, and availability. While it typically requires authentication, it can be exploited by unauthenticated attackers when combined with an authentication bypass vulnerability. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.