CVE-2008-6934

Published Aug 11, 2009

Last updated 7 years ago

Overview

Description: Static code injection vulnerability in Sanus|artificium (aka Sanusart) Free simple guestbook PHP script, when downloaded before 20081111, allows remote attackers to inject arbitrary PHP code into messages.txt via the message parameter to act.php, which is executed when guestbook/guestbook.php is accessed. NOTE: some of these details are obtained from third party information.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:sansuart:free_simple_guestbook_php_script:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4074AA7C-036B-4D65-B5CC-2155C6A96B90"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References