RCE in Sandbox

CVE-2008-5694

PHP remote file inclusion vulnerability in lib/jpgraph/jpgraph_errhandler.inc.php in Sandbox 1.4.1 might allow remote attackers to execute arbitrary PHP code via unspecified vectors. NOTE: the issue, if any, may be located in Aditus JpGraph rather than Sandbox. If so, then this should not be treated as an issue in Sandbox.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.022 (80.7th percentile) — read the EPSS interpretation.

Affected products

Sandbox — versions 1.4.1
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (URL Repurposed, x_refsource_MISC)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)