CVE-2008-6132

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 26%

from disclosure to weapon0 days

Published on NVDFeb 13

1st PoCOct 1

metasploitOct 1

exploitation probability

26%top 2% of all CVEs

observed exploitation

nono source reports it

4 public exploit(s)

Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via the start_date parameter.

Affected products

n/a · n/a

public PoCs found — 4

cve_referencewww.exploit-db.com/exploits/18037unverified cve_referencewww.exploit-db.com/exploits/6646unverified exploitdbwww.exploit-db.com/exploits/18037unverified exploitdbwww.exploit-db.com/exploits/6646unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://phpscheduleit.svn.sourceforge.net/viewvc/phpscheduleit/1.2.11/reserve.php?r1=318&r2=328 http://secunia.com/advisories/32073 https://exchange.xforce.ibmcloud.com/vulnerabilities/45617 http://sourceforge.net/project/shownotes.php?release_id=662749 http://www.exploit-db.com/exploits/18037 http://www.exploit-db.com/exploits/6646 http://www.osvdb.org/48797 http://www.securityfocus.com/bid/31520