Code Execution Vulnerability in Crossday Discuz! Board by Crossday
CVE-2008-6958

Currently unrated

Key Information:

Vendor

Comsenz

Status
Crossday Discuz\! Board
Vendor
CVE Published:
12 August 2009

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2008-6958?

The Crossday Discuz! Board versions 6.x and 7.x contain a vulnerability in the wap/index.php script, which allows remote authenticated users to execute arbitrary PHP code. This is accomplished through manipulation of the creditsformula parameter, leading to potential exploitation of the application. Proper input validation and sanitization measures should be implemented to mitigate this risk.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2008-6958 - Proof of Concept

References

http://www.securityfocus.com/bid/32303
vdb-entryx_refsource_BID
http://osvdb.org/50202
vdb-entryx_refsource_OSVDB
https://www.exploit-db.com/exploits/7119
exploitx_refsource_EXPLOIT-DB

EPSS Score

5% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.