CVE-2008-3763

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-08-21 · updated 2026-06-16
Weakness: CWE-20

Description

Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier, when register_globals is enabled, allows remote attackers to overwrite arbitrary variables related to the db config file. NOTE: this can be leveraged for code injection by overwriting the language file.

Affected products

Turnkeywebtools Php Live Helper: through 2.0.1; 2.0, 2.0-beta_1, 2.0-beta_2, 2.0-beta_3, 2.0-beta_4, 2.0-beta_5 (+1)

References

http://demos.turnkeywebtools.com/phplivehelper/docs/change_log.txt
http://secunia.com/advisories/31521
http://securityreason.com/securityalert/4178
http://www.gulftech.org/?node=research&article_id=00124-08162008
http://www.securityfocus.com/archive/1/495542/100/0/threaded
http://www.securityfocus.com/bid/30729
https://exchange.xforce.ibmcloud.com/vulnerabilities/44570
https://www.exploit-db.com/exploits/6261
http://demos.turnkeywebtools.com/phplivehelper/docs/change_log.txt
http://secunia.com/advisories/31521
http://securityreason.com/securityalert/4178
http://www.gulftech.org/?node=research&article_id=00124-08162008

Get alerted when CVE-2008-3763 or the next vulnerability affects your stack