CVE-2008-3239

Unrestricted file upload vulnerability in the writeLogEntry function in system/v_cron_proc.php in PHPizabi 0.848b C1 HFP1, when register_globals is enabled, allows remote attackers to upload and execute arbitrary code via a filename in the CONF[CRON_LOGFILE] parameter and file contents in the CONF[LOCALE_LONG_DATE_TIME] parameter.

Link	Resource
http://www.securityfocus.com/bid/30257	Exploit
http://secunia.com/advisories/31127	Vendor Advisory
http://securityreason.com/securityalert/4022
https://exchange.xforce.ibmcloud.com/vulnerabilities/43856
https://www.exploit-db.com/exploits/6085

Configuration 1

cpe:2.3:a:phpizabi:phpizabi:0.848b:c1:*:*:*:*:*:* cpe:2.3:a:phpizabi:phpizabi:0.848b:c1_hfp1:*:*:*:*:*:*

---

Published : 2008-07-21 04:41

Updated : 2017-09-29 01:31

---

NVD link : CVE-2008-3239

Mitre link : CVE-2008-3239

No products.

CWE-20