VULNERABILITY INTELLIGENCE
CVE-2008-2638
CVSS score10 HIGH
EPSS probability3.86%
CISA KEVNot currently listed
Published2008-06-10
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Description
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitrary PHP code via the message parameter in an HTML webform, which is written to data.php.
Weakness classification
- CWE-94: Improper Control of Generation of Code ('Code Injection')