CVE-2008-3167 Multiple PHP remote file inclusion vulnerabilities in BoonEx Dolphin 6.1.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) dir[plugins] par...

HighCVSS 9.3 EPSS 6.5%

Published: 2008-07-15 02:00
Updated: 2026-06-17 01:55
Exploit status: No public exploit known

Description

Multiple PHP remote file inclusion vulnerabilities in BoonEx Dolphin 6.1.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) dir[plugins] parameter to (a) HTMLSax3.php and (b) safehtml.php in plugins/safehtml/ and the (2) sIncPath parameter to (c) ray/modules/global/inc/content.inc.php. NOTE: vector 1 might be a problem in SafeHTML instead of Dolphin.

Affected products

Product	Affected versions	Fixed in
boonex dolphin	= 6.1.2	No fix listed

References

30981 third-party-advisory vendor-advisory
30995 third-party-advisory
3993 third-party-advisory
30136 exploit vdb-entry
dolphin-multiple-file-include(43647) vdb-entry
6024 exploit

CVSS v2.0

9.3 High

AV:N/AC:M/Au:N/C:C/I:C/A:C

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Weakness & likelihood

EPSS (exploitation probability, 30 days): 6.46% (percentile 93.8)
CWE: CWE-94

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Boonex Dolphin 6.1.2 - Multiple Remote File Inclusions Exploit · Exploit Database (OffSec) · 2008-07-08