CVE-2006-0852: Direct static code injection vulnerability in write.php in Admbook 1.2.2 and earlier allows remote attacker...

Security readout for executives and security teams

Admbook 1.2.2 and earlier can let a remote attacker turn a normal HTTP header into PHP code stored on the server. If the vulnerable guestbook is reachable, this can become server-side code execution, not just a web page defacement issue. Exposure appears limited to systems still running Admbook 1.2.2 or earlier, especially public PHP guestbook installations with write.php reachable from the internet. Treat internet-facing affected instances as urgent because the impact is remote PHP code execution. Priority drops if Admbook is not deployed or is fully isolated. Mitigation focus: Inventory and remove any exposed Admbook 1.2.2 or earlier installations.; Check vendor or advisory guidance for any confirmed fixed release.; Restrict or disable public access to write.php until remediated..

Prepared

Jun 29, 2026, 14:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.