CVE-2008-4645

plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to execute arbitrary PHP code via PHP sequences in the sort parameter, which is processed by create_function.

Link	Resource
http://www.securityfocus.com/bid/31762	Patch
http://securityreason.com/securityalert/4456
https://exchange.xforce.ibmcloud.com/vulnerabilities/45875
https://www.exploit-db.com/exploits/6755

Configuration 1

cpe:2.3:a:phpwebgallery:phpwebgallery:1.6.2:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.7.1:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.5.2:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.3.1:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.3.3:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.1:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.5.0:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.4.0:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.4.1:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.3.4:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.7.0:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.6.1:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:*:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.2.1:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.3.2:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.5.1:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.6.0:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.0:*:*:*:*:*:*:* cpe:2.3:a:phpwebgallery:phpwebgallery:1.3.0:*:*:*:*:*:*:*

---

Published : 2008-10-22 12:11

Updated : 2017-09-29 01:32

---

NVD link : CVE-2008-4645

Mitre link : CVE-2008-4645

No products.

CWE-94