{"api_version":"1","generated_at":"2026-07-23T09:50:03+00:00","cve":"CVE-2006-4311","urls":{"html":"https://cve.report/CVE-2006-4311","api":"https://cve.report/api/cve/CVE-2006-4311.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-4311","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-4311"},"summary":{"title":"CVE-2006-4311","description":"PHP remote file inclusion vulnerability in Sonium Enterprise Adressbook 0.2 allows remote attackers to execute arbitrary PHP code via the folder parameter in multiple files in the plugins directory, as demonstrated by plugins/1_Adressbuch/delete.php.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2006-08-23 19:04:00","updated_at":"2023-11-07 01:59:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"http://secunia.com/advisories/21553","name":"21553","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"Sonium Enterprise Adressbook \"folder\" File Inclusion Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/443701/100/0/threaded","name":"20060818 Sonium Enterprise Adressbook Version 0.2 (folder) RFI","refsource":"BUGTRAQ","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/3334","name":"ADV-2006-3334","refsource":"VUPEN","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/19597","name":"19597","refsource":"BID","tags":[],"title":"Sonium Enterprise Addressbook Multiple Remote File Include Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28464","name":"sonium-enterprise-delete-file-include(28464)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_%28folder%29_RFI.htm","name":"http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_%28folder%29_RFI.htm","refsource":"","tags":[],"title":"404 Not Found","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_(folder)_RFI.htm","name":"http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_(folder)_RFI.htm","refsource":"MISC","tags":[],"title":"404 Not Found","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-4311","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-4311","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"4311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sonium","cpe5":"enterprise_adressbook","cpe6":"0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4311","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sonium","cpe5":"enterprise_adressbook","cpe6":"0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-4311","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"PHP remote file inclusion vulnerability in Sonium Enterprise Adressbook 0.2 allows remote attackers to execute arbitrary PHP code via the folder parameter in multiple files in the plugins directory, as demonstrated by plugins/1_Adressbuch/delete.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"19597","refsource":"BID","url":"http://www.securityfocus.com/bid/19597"},{"name":"ADV-2006-3334","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/3334"},{"name":"21553","refsource":"SECUNIA","url":"http://secunia.com/advisories/21553"},{"name":"20060818 Sonium Enterprise Adressbook Version 0.2 (folder) RFI","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/443701/100/0/threaded"},{"name":"sonium-enterprise-delete-file-include(28464)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28464"},{"name":"http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_(folder)_RFI.htm","refsource":"MISC","url":"http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_(folder)_RFI.htm"}]}},"nvd":{"publishedDate":"2006-08-23 19:04:00","lastModifiedDate":"2023-11-07 01:59:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sonium:enterprise_adressbook:0.2:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"4311","Ordinal":"19643","Title":"CVE-2006-4311","CVE":"CVE-2006-4311","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"4311","Ordinal":"1","NoteData":"PHP remote file inclusion vulnerability in Sonium Enterprise Adressbook 0.2 allows remote attackers to execute arbitrary PHP code via the folder parameter in multiple files in the plugins directory, as demonstrated by plugins/1_Adressbuch/delete.php.","Type":"Description","Title":null},{"CveYear":"2006","CveId":"4311","Ordinal":"2","NoteData":"2006-08-23","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"4311","Ordinal":"3","NoteData":"2018-10-17","Type":"Other","Title":"Modified"}]}}}