// For flags

CVE-2008-1989

e107 module 123 flash chat 6.8.0 - Remote File Inclusion

Severity Score

10.0
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the e107path parameter.

Vulnerabilidad de inclusión de fichero PHP remoto en 123flashchat.php en el módulo 123 Flash Chat 6.8.0 de e107, cuando 'register_globals' está habilitado, permite a atacantes remotos ejecutar código PHP de su elección mediante una URL en el parámetro "e107patch".

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-04-27 CVE Reserved
  • 2008-04-27 CVE Published
  • 2024-02-22 EPSS Updated
  • 2024-08-07 CVE Updated
  • 2024-08-07 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
123flashchat
Search vendor "123flashchat"
 123 Flash Chat Module
Search vendor "123flashchat" for product "123 Flash Chat Module"
 6.8.0
Search vendor "123flashchat" for product "123 Flash Chat Module" and version "6.8.0"
-
Affected
E107
Search vendor "E107"
 E107
Search vendor "E107" for product "E107"
*-
Affected