1. Home
  2. CVE Database
  3. CVE-2008-1862
MEDIUM · 6.8

CVE-2008-1862

ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY_STRING for certain path manipulations, which allows remote attackers to bypass this check via (1) POST or (2) COOKIE variables,...

Vulnerability Description

ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY_STRING for certain path manipulations, which allows remote attackers to bypass this check via (1) POST or (2) COOKIE variables, a different vector than CVE-2006-4488. NOTE: this can be leveraged to conduct PHP remote file inclusion attacks via a URL in the (a) new_exbb[home_path] or (b) exbb[home_path] parameter to modules/threadstop/threadstop.php.

CVSS Score

6.8

MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL

Affected Products

VendorProductVersions
ExbbExbb Italia<= 0.2.2

Related Weaknesses (CWE)

CWE-20CWE-94

References

FAQ

What is CVE-2008-1862?

CVE-2008-1862 is a vulnerability with a CVSS score of 6.8 (MEDIUM). ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY_STRING for certain path manipulations, which allows remote attackers to bypass this check via (1) POST or (2) COOKIE variables,...

How severe is CVE-2008-1862?

CVE-2008-1862 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2008-1862?

Check the references section above for vendor advisories and patch information. Affected products include: Exbb Exbb Italia.