CVE-2008-2686

Published Jun 13, 2008

Last updated 7 years ago

Overview

Description: webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and PHP sequences in the request body, then making a direct request for this filename.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-20

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:flux_cms:flux_cms:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4F33FBA9-26D8-44D2-8DC6-748D0CD24A39",
            "versionEndIncluding": "1.50"
          },
          {
            "criteria": "cpe:2.3:a:flux_cms:flux_cms:1.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F208450A-A587-41FA-8A8D-000C4CDD4C76"
          },
          {
            "criteria": "cpe:2.3:a:flux_cms:flux_cms:1.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3E60F331-132D-4EAE-8998-6ABCC4B7906B"
          },
          {
            "criteria": "cpe:2.3:a:flux_cms:flux_cms:1.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D77F330E-E841-421C-91C7-734BDF833ED4"
          },
          {
            "criteria": "cpe:2.3:a:flux_cms:flux_cms:1.31:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A408092F-B14B-4B8A-B3ED-A533A81EF2E1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References