critical9.0Public exploit code
CVE-2008-4645
plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to execute arbitrary PHP code via PHP sequenc…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHPWebGallery 1.7.2 - Session Hijacking / Code Execution2008-10-14 · webapps · php · Verified
Impact
plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to execute arbitrary PHP code via PHP sequences in the sort parameter, which is processed by create_function.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phpwebgallery | Phpwebgallery | through 1.7.2 Versions 1.0, 1.1, 1.2.1, 1.3.0, 1.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://securityreason.com/securityalert/4456
- http://www.securityfocus.com/bid/31762
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45875
- https://www.exploit-db.com/exploits/6755
- http://securityreason.com/securityalert/4456
- http://www.securityfocus.com/bid/31762
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45875
- https://www.exploit-db.com/exploits/6755