PT-2008-6746 · Php · Php

Published 2008-12-19 · Updated 2024-02-14 · CVE-2008-5694

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sandbox version 1.4.1

Description A remote file inclusion issue in lib/jpgraph/jpgraph errhandler.inc.php might allow remote attackers to execute arbitrary PHP code. The issue may be located in Aditus JpGraph rather than Sandbox.

Recommendations For version 1.4.1, consider restricting access to the lib/jpgraph/jpgraph errhandler.inc.php file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-5694

Affected Products

Php

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2008-5694 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47688 · Note
• http://by-f10.com/bug.txt · Note
• http://securityfocus.com/archive/1/487903/100/200/threaded · Note