CVEvulnerability
CVE-2008-2638
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2008-06-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-94
Description
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitrary PHP code via the message parameter in an HTML webform, which is written to data.php.
Affected configurations
• 1-script 1-book (<= 1.0.1)
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://1scripts.net/php-scripts/index.php?p=16 1scripts.net
- http://secunia.com/advisories/30146 Vendor Advisory
- http://www.vupen.com/english/advisories/2008/1735/references www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42854 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/5736 www.exploit-db.com
- http://1scripts.net/php-scripts/index.php?p=16 1scripts.net
- http://secunia.com/advisories/30146 Vendor Advisory
- http://www.vupen.com/english/advisories/2008/1735/references www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42854 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/5736 www.exploit-db.com