CVE-2008-3354: Code Injection
Multiple PHP remote file inclusion vulnerabilities in the Newbb Plus (newbbplus) module 0.93 in RunCMS 1.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) bbPath[path] parameter to votepolls.php and the (2) bbPath[roottheme] parameter to config.php, different vectors than CVE-2006-0659. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3354?
CVE-2008-3354 is considered a critical vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2008-3354?
To fix CVE-2008-3354, upgrade Newbb Plus module to a version that has patched the vulnerabilities.
What vulnerabilities are associated with CVE-2008-3354?
CVE-2008-3354 is associated with multiple PHP remote file inclusion vulnerabilities affecting the Newbb Plus module.
Which versions of RunCMS are affected by CVE-2008-3354?
RunCMS version 1.6.1 and Newbb Plus module version 0.93 are affected by CVE-2008-3354.
Can CVE-2008-3354 be exploited remotely?
Yes, CVE-2008-3354 can be exploited remotely by attackers to execute arbitrary PHP code.