CVE-2008-2886

PHP remote file inclusion vulnerability in include/plugins/jrBrowser/purchase.php in Jamroom 3.3.0 through 3.3.5, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the jamroom[jm_dir] parameter.

Link	Resource
http://www.jamroom.net/	Patch
http://www.jamroom.net/index.php?m=td_tracker&o=view&id=1130
http://www.securityfocus.com/bid/29854	Exploit
http://secunia.com/advisories/30806	Vendor Advisory
http://securityreason.com/securityalert/3961
https://exchange.xforce.ibmcloud.com/vulnerabilities/43299
https://www.exploit-db.com/exploits/5876

Configuration 1

cpe:2.3:a:jamroom:jamroom:3.3.5:*:*:*:*:*:*:* cpe:2.3:a:jamroom:jamroom:3.3.0:*:*:*:*:*:*:* cpe:2.3:a:jamroom:jamroom:3.3.2:*:*:*:*:*:*:* cpe:2.3:a:jamroom:jamroom:3.3.3:*:*:*:*:*:*:* cpe:2.3:a:jamroom:jamroom:3.3.1:*:*:*:*:*:*:* cpe:2.3:a:jamroom:jamroom:3.3.4:*:*:*:*:*:*:*

---

Published : 2008-06-27 06:41

Updated : 2017-09-29 01:31

---

NVD link : CVE-2008-2886

Mitre link : CVE-2008-2886

No products.

CWE-94