CVE-2008-0390 - stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via the X-Forwarded-For HTTP header in a stat action to index.php, and execute online.db.txt via a certain request to index.php

Back Back to CVE browser

HIGH

stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via the X-Forwarded-For HTTP header in a stat action to index.php, and execute online.db.txt via a certain request to index.php

Published Jan 23, 2008

7.5

HIGH

CVSS 2.0

EPSS 2.32%

Description

stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via the X-Forwarded-For HTTP header in a stat action to index.php, and execute online.db.txt via a certain request to index.php.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (4)

http://www.securityfocus.com/bid/27342
vdb-entryx_refsource_BIDExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2008-0400
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/39777
vdb-entryx_refsource_XF
https://www.exploit-db.com/exploits/4933
exploitx_refsource_EXPLOIT-DB

Link	Providers	Tags
http://www.securityfocus.com/bid/27342		vdb-entryx_refsource_BIDExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2008-0400		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/39777		vdb-entryx_refsource_XF
https://www.exploit-db.com/exploits/4933		exploitx_refsource_EXPLOIT-DB