CVE-2006-5795

CVE-2006-5795 describes multiple remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, specifically when the register_globals PHP setting is enabled. An unauthenticated remote attacker can exploit these flaws by injecting a malicious URL into the 'srcdir' parameter across numerous PHP scripts, leading to arbitrary PHP code execution. This vulnerability carries a CVSS score of 7.5, indicating a high severity with network-based attacks, low attack complexity, and potential for full compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog or Hot List, exploit code is publicly available via ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.