CVEvulnerability

CVE-2008-5071

9.0 HIGH Published 2008-11-14 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-11-14
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
Weaknesses
CWE-94

Description

Multiple eval injection vulnerabilities in itpm_estimate.php in Yoxel 1.23beta and earlier allow remote authenticated users to execute arbitrary PHP code via the proj_id parameter.

Affected configurations

• yoxel yoxel (<= 1.23beta) • yoxel yoxel 1.06beta • yoxel yoxel 1.07beta • yoxel yoxel 1.08beta • yoxel yoxel 1.09beta • yoxel yoxel 1.10beta • yoxel yoxel 1.11beta • yoxel yoxel 1.12beta • yoxel yoxel 1.13beta • yoxel yoxel 1.14beta • yoxel yoxel 1.15beta • yoxel yoxel 1.16beta • yoxel yoxel 1.17beta • yoxel yoxel 1.18beta • yoxel yoxel 1.19beta • yoxel yoxel 1.20 • yoxel yoxel 1.20beta • yoxel yoxel 1.21 • yoxel yoxel 1.21beta • yoxel yoxel 1.22 • yoxel yoxel 1.22beta

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

Referenced by CWE · observed example (2)

  • CWE-94 Improper Control of Generation of Code weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References