CVE-2008-2638

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-06-10 · updated 2026-06-16
Weakness: CWE-94

Description

Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitrary PHP code via the message parameter in an HTML webform, which is written to data.php.

Affected products

1-Script 1-Book: through 1.0.1

References

http://1scripts.net/php-scripts/index.php?p=16
http://secunia.com/advisories/30146
http://www.vupen.com/english/advisories/2008/1735/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42854
https://www.exploit-db.com/exploits/5736
http://1scripts.net/php-scripts/index.php?p=16
http://secunia.com/advisories/30146
http://www.vupen.com/english/advisories/2008/1735/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42854
https://www.exploit-db.com/exploits/5736

Get alerted when CVE-2008-2638 or the next vulnerability affects your stack