CVE-2008-5694
PHP remote file inclusion vulnerability in lib/jpgraph/jpgraph_errhandler.inc.php in Sandbox 1.4.1 might allow remote attackers to execute arbitrary PHP code via unspecified vectors.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.20%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
PHP remote file inclusion vulnerability in lib/jpgraph/jpgraph_errhandler.inc.php in Sandbox 1.4.1 might allow remote attackers to execute arbitrary PHP code via unspecified vectors. NOTE: the issue, if any, may be located in Aditus JpGraph rather than Sandbox. If so, then this should not be treated as an issue in Sandbox.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 2.20% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- sandbox/sandbox
- Source
- cve@mitre.org
References
- http://www.by-f10.com/bug.txtURL Repurposed
- http://www.securityfocus.com/archive/1/487903/100/200/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47688
- http://www.by-f10.com/bug.txtURL Repurposed
- http://www.securityfocus.com/archive/1/487903/100/200/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47688
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.