CVE-2006-4656

The exploit describes a remote file inclusion vulnerability in SL_Site <= 1.0 due to an unsanitized $spaw_root variable when register_globals is enabled. The attacker can inject a malicious script via the spaw_root parameter in the spaw_control.class.php file.

This exploit demonstrates a Remote File Include (RFI) vulnerability in Download-Engine 1.4.2. The vulnerability allows an attacker to include and execute arbitrary remote files by manipulating the 'spaw_root' parameter in the 'spaw_control.class.php' script.