Executive Summary

Informations
NameCVE-2008-5764First vendor Publication2008-12-30
VendorCveLast vendor Modification2017-09-28

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score9.3Attack RangeNetwork
Cvss Impact Score10Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Security Protection

ImpactsProvides administrator access : Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.

Detail

PHP remote file inclusion vulnerability in calendar.php in WorkSimple 1.2.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5764

CAPEC : Common Attack Pattern Enumeration & Classification

idName
CAPEC-13Subverting Environment Variable Values
CAPEC-64Using Slashes and URL Encoding Combined to Bypass Validation Logic
CAPEC-72URL Encoding
CAPEC-76Manipulating Input to File System Calls
CAPEC-78Using Escaped Slashes in Alternate Encoding
CAPEC-79Using Slashes in Alternate Encoding
CAPEC-80Using UTF-8 Encoding to Bypass Validation Logic

CWE : Common Weakness Enumeration

%idName
100 %CWE-94Failure to Control Generation of Code ('Code Injection')

CPE : Common Platform Enumeration

TypeDescriptionCount
Application1

Open Source Vulnerability Database (OSVDB)

idDescription
50726WorkSimple calendar.php lang Parameter Remote File Inclusion
50725WorkSimple data/usr.txt Direct Request Credentials Disclosure

Sources (Detail)

SourceUrl
BID http://www.securityfocus.com/bid/32849
EXPLOIT-DB https://www.exploit-db.com/exploits/7481
SREASON http://securityreason.com/securityalert/4831
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/47361

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
DateInformations
2017-09-29 09:23:53
  • Multiple Updates
2017-08-08 09:24:36
  • Multiple Updates
2016-06-28 17:23:48
  • Multiple Updates
2016-04-26 18:11:01
  • Multiple Updates
2013-05-11 00:33:47
  • Multiple Updates