CVE-2008-2638

Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitrary PHP code via the message parameter in an HTML webform, which is written to data.php.

Score

CVSS 2.0 10.0 Critical

Status

Modified - cve@mitre.org

Published

2008-06-10

Last modified

2024-08-07

Weaknesses

CWE-94

Affected products

• 1-book (1-script)

References

• http://1scripts.net/php-scripts/index.php?p=16
• http://secunia.com/advisories/30146
• http://www.vupen.com/english/advisories/2008/1735/references
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42854
• https://www.exploit-db.com/exploits/5736