RCE in Cmsworks

CVE-2008-2877

PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mod_root parameter.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.018 (76.4th percentile) — read the EPSS interpretation.

Affected products

  • Cmsworks — versions 2.2
  • N/a — versions n/a

Weakness classification (CWE)

References