CVE-2008-1989: Code Injection
Published Apr 27, 2008
·Updated
PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the e107path parameter.
Affected Software
2 affected components
e107 e107
123flashchat 123 Flash Chat Module=6.8.0
Event History
Apr 27, 2008
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-1989?
CVE-2008-1989 is considered a high severity vulnerability due to the potential for remote code execution.
2
How do I fix CVE-2008-1989?
To fix CVE-2008-1989, disable register_globals and update to the latest version of the affected software.
3
What software is affected by CVE-2008-1989?
CVE-2008-1989 affects the e107 CMS and the 123 Flash Chat module version 6.8.0.
4
Can CVE-2008-1989 be exploited remotely?
Yes, CVE-2008-1989 can be exploited remotely by an attacker via a crafted URL.
5
What is the vector for the attack related to CVE-2008-1989?
The attack vector for CVE-2008-1989 involves the e107path parameter within the 123flashchat.php file.