CVE-2008-1860 Static code injection vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to inject arbitrary PHP code into includes/Config.php via the default parameter.
HighCVSS 9.3
EPSS 3.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Static code injection vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to inject arbitrary PHP code into includes/Config.php via the default parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lokicms | <= 0.3.3 | No fix listed |
| lokicms | = 0.1.0 | No fix listed |
| lokicms | = 0.1.0rc1 | No fix listed |
| lokicms | = 0.2.0 | No fix listed |
| lokicms | = 0.3.0 | No fix listed |
| lokicms | = 0.3.1b1 | No fix listed |
| lokicms | = 0.3.1b2 | No fix listed |
| lokicms | = 0.3.2b1 | No fix listed |
References
- 29749 third-party-advisory vendor-advisory
- 20080531 LokiCMS Multiple Vulnerabilities through Authorization weakness mailing-list
- ADV-2008-1162 vdb-entry
- lokicms-admin-code-execution(41736) vdb-entry
- 5408 exploit