CVE-2008-6482: Code Injection
PHP remote file inclusion vulnerability in admin.treeg.php in the Flash Tree Gallery (comtreeg) component 1.0 for Joomla!, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfiglivesite parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set register_globals = Off in your PHP configuration (php.ini) and restart the web server to disable register_globals.
PHP (php.ini) register_globals = Off - Compensating control
Configure a web application firewall or web-server rule to block or drop HTTP requests that include the mosConfig_live_site parameter for the Flash Tree Gallery (com_treeg) admin.treeg.php component to prevent remote file inclusion attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6482?
CVE-2008-6482 is considered a critical vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2008-6482?
To fix CVE-2008-6482, disable register_globals and upgrade the Flash Tree Gallery component to a secured version.
What types of attacks can exploit CVE-2008-6482?
CVE-2008-6482 can be exploited through remote file inclusion attacks, allowing attackers to execute arbitrary PHP code.
Which versions of Joomla! are affected by CVE-2008-6482?
CVE-2008-6482 specifically affects version 1.0 of the Flash Tree Gallery component for Joomla! when register_globals is enabled.
Is it necessary to have register_globals enabled to exploit CVE-2008-6482?
Yes, CVE-2008-6482 requires register_globals to be enabled for the vulnerability to be exploited.