CVE-2006-5667 in P-Book
Summary
by MITRE
Multiple PHP remote file inclusion vulnerabilities in P-Book 1.17 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pb_lang parameter to (1) admin.php and (2) pbook.php.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/26/2026
The vulnerability identified as CVE-2006-5667 represents a critical remote code execution flaw affecting P-Book version 1.17 and earlier. This vulnerability resides in the application's handling of user-supplied input through the pb_lang parameter, which is processed in two primary files: admin.php and pbook.php. The flaw enables attackers to inject malicious URLs that are then executed as PHP code on the target server, creating a severe security risk that can lead to complete system compromise. This type of vulnerability falls under the category of insecure direct object references and improper input validation, both of which are classified under CWE-20 and CWE-94 respectively in the Common Weakness Enumeration catalog. The vulnerability directly aligns with ATT&CK technique T1190 which describes the use of remote file inclusion attacks to execute arbitrary code on target systems.
The technical exploitation of this vulnerability occurs when an attacker crafts a malicious URL and passes it through the pb_lang parameter in the HTTP request to either admin.php or pbook.php endpoints. The application fails to properly validate or sanitize this input before using it in file inclusion operations, allowing the attacker to specify external URLs that contain malicious PHP code. When the application processes this input, it effectively includes and executes the remote file, providing the attacker with arbitrary code execution capabilities on the vulnerable system. This flaw demonstrates poor input sanitization practices and lacks proper access controls that should prevent external file inclusion operations from being executed within the application context.
The operational impact of this vulnerability is substantial and far-reaching for any organization using affected P-Book installations. Successful exploitation can result in complete system compromise, allowing attackers to execute commands, access sensitive data, modify application functionality, and potentially establish persistent backdoors. The vulnerability affects the application's core functionality and can lead to data breaches, system availability issues, and unauthorized access to sensitive information. Organizations may experience significant business disruption and regulatory compliance violations if exploited, as the vulnerability enables attackers to gain full control over the affected web server and its resources. The remote nature of the vulnerability means that attackers can exploit it from anywhere on the internet without requiring local system access or credentials.
Mitigation strategies for this vulnerability should focus on immediate patching and input validation improvements. Organizations must upgrade to P-Book versions that address this vulnerability, as no official patches were available for versions prior to 1.18. The recommended approach includes implementing strict input validation that rejects any non-local file references in the pb_lang parameter, using allowlists of acceptable language values instead of accepting arbitrary URLs, and implementing proper output encoding for all user-supplied inputs. Additionally, network-level protections such as web application firewalls can be deployed to detect and block malicious requests containing suspicious URL patterns in the pb_lang parameter. Security configurations should enforce the principle of least privilege and disable unnecessary file inclusion features to reduce the attack surface. Organizations should also implement regular security assessments and vulnerability scanning to identify similar issues in other applications and maintain up-to-date security patches across all systems.