9.3

CVE-2008-3239

Exploit
Unrestricted file upload vulnerability in the writeLogEntry function in system/v_cron_proc.php in PHPizabi 0.848b C1 HFP1, when register_globals is enabled, allows remote attackers to upload and execute arbitrary code via a filename in the CONF[CRON_LOGFILE] parameter and file contents in the CONF[LOCALE_LONG_DATE_TIME] parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Phpizabi ≫ Phpizabi Version0.848b Updatec1
Phpizabi ≫ Phpizabi Version0.848b Updatec1_hfp1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.17% 0.914
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://secunia.com/advisories/31127
Vendor Advisory
http://securityreason.com/securityalert/4022
http://www.securityfocus.com/bid/30257
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/43856
https://www.exploit-db.com/exploits/6085