Vulnerability CVE-2008-5090
Published: 2008-11-14   Modified: 2012-02-12

Description:
Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the email parameter, which is processed by the preg_replace function with the eval switch.

See advisories in our WLB2 database:
Topic
Author
Date
High
Advanced Electron Forum <= 1.0.6 Remote Code Execution
GulfTech Securit...
21.09.2008

Type:

CWE-94

 (Improper Control of Generation of Code ('Code Injection'))

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Anelectron -> Advanced electron forum 

 References:
http://securityreason.com/securityalert/4598
http://www.anelectron.com/board/index.php?tid=3282
http://www.gulftech.org/?node=research&article_id=00131-09202008
http://www.securityfocus.com/archive/1/496552/100/0/threaded
http://www.securityfocus.com/bid/31268
https://exchange.xforce.ibmcloud.com/vulnerabilities/45270
https://www.exploit-db.com/exploits/6499
Copyright 2024, cxsecurity.com

 

Back to Top