CVE-2008-7183: Code Injection

Published Sep 8, 2009

Updated

PHP remote file inclusion vulnerability in eva/index.php in EVA CMS 2.3.1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the eva[caminho] parameter to index.php.

Affected Software

1 affected component

Evacms Eva Cms=2.3.1

Event History

Sep 8, 2009

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-7183?

CVE-2008-7183 is considered to have a high severity due to the potential for remote code execution.

How do I fix CVE-2008-7183?

To mitigate CVE-2008-7183, disable register_globals in your PHP configuration and upgrade to a patched version of EVA CMS.

What systems are affected by CVE-2008-7183?

CVE-2008-7183 specifically affects EVA CMS version 2.3.1 when register_globals is enabled.

What does CVE-2008-7183 allow attackers to do?

CVE-2008-7183 allows attackers to execute arbitrary PHP code via a crafted URL in the eva[caminho] parameter.

How can I confirm if my system is vulnerable to CVE-2008-7183?

You can confirm vulnerability to CVE-2008-7183 by checking if EVA CMS version 2.3.1 is installed with register_globals enabled.