CVE-2008-5090 Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the email parameter, which is processed by the preg_replace....
HighCVSS 10.0
EPSS 4.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the email parameter, which is processed by the preg_replace function with the eval switch.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| anelectron advanced electron forum | <= 1.0.6 | No fix listed |
| anelectron advanced electron forum | = 1.0.1 | No fix listed |
| anelectron advanced electron forum | = 1.0.2 | No fix listed |
| anelectron advanced electron forum | = 1.0.3 | No fix listed |
| anelectron advanced electron forum | = 1.0.4 | No fix listed |
| anelectron advanced electron forum | = 1.0.5 | No fix listed |
References
- 31978 third-party-advisory vendor-advisory
- 4598 third-party-advisory
- www.anelectron.com vendor-advisory
- www.gulftech.org
- 20080920 Advanced Electron Forum <= 1.0.6 Remote Code Execution mailing-list
- 31268 exploit vdb-entry
- aef-pregreplace-code-execution(45270) vdb-entry
- 6499 exploit