CVE-2008-5060 Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to (1) export_batch.inc.php, (2) ru...
HighCVSS 10.0
EPSS 3.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the DIR parameter to (1) export_batch.inc.php, (2) run_auto_suspend.cron.php, and (3) send_email_cache.php in include/scripts/; (4) include/misc/mod_2checkout/2checkout_return.inc.php; and (5) include/html/nettools.popup.php, different vectors than CVE-2006-4034 and CVE-2005-1054.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| modernbill | <= 4.4 | No fix listed |
| modernbill | <= 4.4.0 | No fix listed |
| modernbill | = 2.01 | No fix listed |
| modernbill | = 2.02s | No fix listed |
| modernbill | = 3.0-beta | No fix listed |
| modernbill | = 3.1.0 | No fix listed |
| modernbill | = 3.1.3 | No fix listed |
| modernbill | = 4.0.1-rc7 | No fix listed |
| modernbill | = 4.0.1-rc8 | No fix listed |
| modernbill | = 4.0.2 | No fix listed |
| modernbill | = 4.1.1 | No fix listed |
| modernbill | = 4.1.2 | No fix listed |
| modernbill | = 4.1.3 | No fix listed |
| modernbill | = 4.2.1 | No fix listed |
| modernbill | = 4.3.0 | No fix listed |
| modernbill | = 4.3.2 | No fix listed |
References
- 32529 third-party-advisory vendor-advisory
- 4587 third-party-advisory
- modernbill-dir-file-include(46513) vdb-entry
- 6916 exploit