RCE in Phpslash
CVE-2009-0517
Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary PHP code via the fields parameter, which is supplied to an eval function call within the generic function in include/cla…
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.550 (98.9th percentile) — read the EPSS interpretation.
Affected products
- Phpslash — versions 0.5.3.2, 0.6, 0.6.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
Frequently asked questions
- What is CVE-2009-0517?
- CVE-2009-0517 is a vulnerability in Phpslash, classified under Code Injection. Published 2009-02-11.
- Is CVE-2009-0517 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.