CVE-2006-4311

PHP remote file inclusion vulnerability in Sonium Enterprise Adressbook 0.2 allows remote attackers to execute arbitrary PHP code via the folder parameter in multiple files in the plugins directory, as demonstrated by plugins/1_Adressbuch/delete.php.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/21553	Vendor Advisory
http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_%28folder%29_RFI.htm
http://www.securityfocus.com/archive/1/443701/100/0/threaded
http://www.securityfocus.com/bid/19597
http://www.vupen.com/english/advisories/2006/3334
https://exchange.xforce.ibmcloud.com/vulnerabilities/28464

Configurations

Configuration 1 (hide)

cpe:2.3:a:sonium:enterprise_adressbook:0.2:*:*:*:*:*:*:*

History

No history.

Information

Published : 2006-08-23 19:04

Updated : 2023-11-07 01:59

NVD link : CVE-2006-4311

Mitre link : CVE-2006-4311

CVE.ORG link : CVE-2006-4311

JSON object : View

Products Affected

sonium

enterprise_adressbook

CWE

NVD-CWE-Other

{"id": "CVE-2006-4311", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-08-23T19:04:00.000", "references": [{"url": "http://secunia.com/advisories/21553", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_%28folder%29_RFI.htm", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/443701/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/19597", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/3334", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28464", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "PHP remote file inclusion vulnerability in Sonium Enterprise Adressbook 0.2 allows remote attackers to execute arbitrary PHP code via the folder parameter in multiple files in the plugins directory, as demonstrated by plugins/1_Adressbuch/delete.php."}, {"lang": "es", "value": "Vulnerabilidad de inclusi\u00f3n remota de archivo en Sonium Enterprise Adressbook 0.2 permite a un atacante remoto provocar ejecutar c\u00f3digo PHP de su elecci\u00f3n a trav\u00e9s del par\u00e1meto folder en m\u00faltiples archivos en los directorios pulignsm como se demostr\u00f3 por plugins/1_Adressbuch/delete.php."}], "lastModified": "2023-11-07T01:59:15.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sonium:enterprise_adressbook:0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0DC1E2C-DED9-440E-81A2-083D1CF66F25"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}