CVE-2008-2638

🗓️ 10 Jun 2008 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 93 Views🌐 WEB

Static code injection in 1Book 1.0.1 & earlier via guestbook.ph

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2008-2638	3 Jun 200800:00	–	circl
Cvelist	CVE-2008-2638	10 Jun 200800:00	–	cvelist
Exploit DB	1Book Guestbook Script 1.0.1 - Code Execution	3 Jun 200800:00	–	exploitdb
EUVD	EUVD-2008-2633	7 Oct 202500:30	–	euvd
NVD	CVE-2008-2638	10 Jun 200800:32	–	nvd
Prion	Code injection	10 Jun 200800:32	–	prion
Rapid7 Vulnerability Database (full)	CVE-2008-2638: Improper Control of Generation of Code	10 Jun 200800:00	–	rapid7

NVD

Node

1-script 1-bookRange≤1.0.1

Source	Link
vupen	www.vupen.com/english/advisories/2008/1735/references
1scripts	www.1scripts.net/php-scripts/index.php
secunia	www.secunia.com/advisories/30146
exploit-db	www.exploit-db.com/exploits/5736
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/42854

Parameter	Position	Path	Description	CWE
message	request body	site/guestbook.php	Remote code execution via PHP code injected in the message parameter written to data.php.	CWE-94
jiko	query param	script/data/data.php	Remote code execution by passing a shell through the jiko parameter to data.php.	CWE-94

16 Jun 2026 22:54Current

7.2High risk

Vulners AI Score7.2

CVSS 210

EPSS0.0386

cve-2008-2638 static code injection 1book php vulnerability webform nvd