CVE-2008-5938 PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary....
MediumCVSS 6.8
EPSS 2.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the reflect_base parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| modxcms | <= 0.9.6.2 | No fix listed |
| modxcms | = 0.9.0 | No fix listed |
| modxcms | = 0.9.1 | No fix listed |
| modxcms | = 0.9.2.1 | No fix listed |
| modxcms | = 0.9.5 | No fix listed |
| modxcms | = 0.9.6 | No fix listed |
| modxcms | = 0.9.6.1 | No fix listed |
References
- 32824 third-party-advisory vendor-advisory
- 4940 third-party-advisory
- svn.modxcms.com vendor-advisory
- 32436 exploit vdb-entry
- ADV-2008-3236 vdb-entry
- modx-snippetreflect-file-include(46797) vdb-entry
- 7204 exploit