Lucene search

MitreCVE-2008-0289

HistoryJan 16, 2008 - 2:00 a.m.

CVE-2008-0289

2008-01-1602:00:00

CWE-94

mitre

web.nvd.nist.gov

cve-2008-0289

php

remote file inclusion

member area system

mas 1.7

arbitrary code execution

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.7

Confidence

High

EPSS

0.063

Percentile

93.6%

JSON

PHP remote file inclusion vulnerability in view_func.php in Member Area System (MAS) 1.7 and possibly others allows remote attackers to execute arbitrary PHP code via a URL in the i parameter. NOTE: a second vector might exist via the l parameter. NOTE: as of 20080118, the vendor has disputed the set of affected versions, stating that the issue “is already fixed, for almost a year.”

Affected configurations

Nvd

Node

mansion_productionsmember_area_systemRange≤1.7

VendorProductVersionCPE
mansion_productionsmember_area_system*cpe:2.3:a:mansion_productions:member_area_system:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mansion_productions	member_area_system	*	cpe:2.3:a:mansion_productions:member_area_system::::::::

References

securityreason.com/securityalert/3547

www.securityfocus.com/archive/1/486172/100/0/threaded

www.securityfocus.com/archive/1/486618/100/0/threaded

www.securityfocus.com/bid/27244

exchange.xforce.ibmcloud.com/vulnerabilities/39611

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.7

Confidence

High

EPSS

0.063

Percentile

93.6%

JSON

Related for CVE-2008-0289