CVE-2008-3707: Code Injection
Multiple PHP remote file inclusion vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to execute arbitrary PHP code via a URL in the scriptpath parameter to (1) flatread.php, (2) post.php, (3) processpost.php, (4) processsearch.php, (5) forum.php, (6) processsubscribe.php, (7) read.php, (8) search.php, (9) subscribe.php in path/; and (10) addban.php, (11) addbanform.php, (12) addboard.php, (13) addvip.php, (14) addvipform.php, (15) copyban.php, (16) copyvip.php, (17) deleteban.php, (18) deleteboard.php, (19) deletemessages.php, (20) deletevip.php, (21) editban.php, (22) editboard.php, (23) editvip.php, (24) index.php, (25) lockmessages.php, (26) login.php, (27) modifybanlist.php, (28) modifyviplist.php, (29) movemessages.php, (30) processaddboard.php, (31) processban.php, (32) processdeleteban.php, (33) processdeleteboard.php, (34) processdeletemessages.php, (35) processdeletevip.php, (36) processeditboard.php, (37) processlockmessages.php, (38) processlogin.php, (39) processmovemessages.php, (40) processstickymessages.php, (41) processvip.php, and (42) stickymessages.php in path/adminopts. NOTE: the include/common.php vector is covered by CVE-2006-2871. NOTE: some of these vectors might not be vulnerabilities under proper installation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3707?
CVE-2008-3707 has been classified as a high severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2008-3707?
To fix CVE-2008-3707, you should upgrade to the latest version of CyBoards PHP Lite that contains the necessary patches.
What are the affected components by CVE-2008-3707?
CVE-2008-3707 affects multiple components of CyBoards PHP Lite 1.21 including flat_read.php, post.php, and forum.php.
What can attackers do exploiting CVE-2008-3707?
Exploiting CVE-2008-3707 allows attackers to execute arbitrary PHP code on the server by manipulating the script_path parameter.
Is CVE-2008-3707 easy to exploit?
Yes, CVE-2008-3707 is considered easy to exploit if the target is running the vulnerable version of CyBoards PHP Lite without security measures.