Vulnerability record · CVE-2006-1551 · published 13 April 2006
CVE-2006-1551: PAJAX pajax_call_dispatcher.php eval injection allows remote code execution
GGeorges Auberger · Pajax
PAJAX 0.5.1 and earlier passes the $method and $args parameters of pajax_call_dispatcher.php into an eval call without sanitization, creating an eval injection flaw. A remote, unauthenticated attacker can inject PHP code that the server executes, so any exposed PAJAX endpoint is a direct code execution path.
Description
Eval injection vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via the (1) $method and (2) $args parameters.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote code execution with a high EPSS score and public exploit references, though no KEV listing or confirmed in-the-wild activity is recorded.
What it is
PAJAX 0.5.1 and earlier passes the $method and $args parameters of pajax_call_dispatcher.php into an eval call without sanitization, creating an eval injection flaw. A remote, unauthenticated attacker can inject PHP code that the server executes, so any exposed PAJAX endpoint is a direct code execution path.
Impact
An attacker gains arbitrary code execution in the context of the web server, which can lead to full compromise of the application and its data.
Attack surface
Reachable over the network through HTTP requests to pajax_call_dispatcher.php; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
No CISA KEV listing and no ransomware associations are recorded, but EPSS is 0.50632 (98.9th percentile) and a reference is tagged Exploit, indicating public exploit material exists.
What to do
- Upgrade or remove PAJAX 0.5.1 and earlier; the record does not name a fixed version, so confirm with the vendor or replace the library.
- If upgrade is not possible, block or restrict access to pajax_call_dispatcher.php at the web server or WAF.
- Audit and remove any eval-based dispatch of user-supplied method or argument values in the application code.
- Run the web service with least privilege and disable dangerous PHP functions where feasible to limit code execution impact.
Detection
- Inspect web logs for requests to pajax_call_dispatcher.php with unusual $method or $args values containing PHP code or function calls.
- Monitor for PHP errors, warnings or unexpected output from eval in application logs.
- Watch for outbound connections or child processes spawned by the web server user that are not normal application behavior.
- Search file system and process telemetry for webshell-like artifacts or code execution traces following PAJAX requests.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-1551 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-1551), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
