CVE-2006-5667

p-book < 1.17 - Remote File Inclusion via pb_lang Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-5667. PoCs published by Matdhule.

AI-analyzed exploit summary This is an advisory detailing a remote file inclusion vulnerability in P-Book <= 1.17. The vulnerability allows arbitrary PHP code execution by manipulating the 'pb_lang' parameter in admin.php and pbook.php.

Description

Multiple PHP remote file inclusion vulnerabilities in P-Book 1.17 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pb_lang parameter to (1) admin.php and (2) pbook.php.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Matdhule · textwebappsphp

https://www.exploit-db.com/exploits/2691

View Code ZIP pw:eip

This is an advisory detailing a remote file inclusion vulnerability in P-Book <= 1.17. The vulnerability allows arbitrary PHP code execution by manipulating the 'pb_lang' parameter in admin.php and pbook.php.

Classification

Writeup 100%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: P-Book <= 1.17

No auth needed

Prerequisites: Network access to the target application · Ability to host a malicious PHP file on an external server

MITRE ATT&CK