CVE-2008-4645 plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to execute arbitrary PHP code via PHP sequences in the sort parameter, which is proces...
HighCVSS 9.0
EPSS 7.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to execute arbitrary PHP code via PHP sequences in the sort parameter, which is processed by create_function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpwebgallery | <= 1.7.2 | No fix listed |
| phpwebgallery | = 1.0 | No fix listed |
| phpwebgallery | = 1.1 | No fix listed |
| phpwebgallery | = 1.2.1 | No fix listed |
| phpwebgallery | = 1.3.0 | No fix listed |
| phpwebgallery | = 1.3.1 | No fix listed |
| phpwebgallery | = 1.3.2 | No fix listed |
| phpwebgallery | = 1.3.3 | No fix listed |
| phpwebgallery | = 1.3.4 | No fix listed |
| phpwebgallery | = 1.4.0 | No fix listed |
| phpwebgallery | = 1.4.1 | No fix listed |
| phpwebgallery | = 1.5.0 | No fix listed |
| phpwebgallery | = 1.5.1 | No fix listed |
| phpwebgallery | = 1.5.2 | No fix listed |
| phpwebgallery | = 1.6.0 | No fix listed |
| phpwebgallery | = 1.6.1 | No fix listed |
| phpwebgallery | = 1.6.2 | No fix listed |
| phpwebgallery | = 1.7.0 | No fix listed |
| phpwebgallery | = 1.7.1 | No fix listed |
References
- 4456 third-party-advisory
- 31762 patch vdb-entry
- phpwebgallery-createfunction-code-execution(45875) vdb-entry
- 6755 exploit