CVE-2008-4448

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-10-06 · updated 2026-06-16
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to perform unauthorized actions as an administrator, including file deletion and creation, via a link or IMG tag to the (1) overkill, (2) futils, or (3) edit actions.

Affected products

Positive Software H-Sphere: 4.3.10

References

http://packetstormsecurity.org/0810-exploits/webshell431-xssxsrf.txt
http://secunia.com/advisories/32086
https://exchange.xforce.ibmcloud.com/vulnerabilities/45614
http://packetstormsecurity.org/0810-exploits/webshell431-xssxsrf.txt
http://secunia.com/advisories/32086
https://exchange.xforce.ibmcloud.com/vulnerabilities/45614

Get alerted when CVE-2008-4448 or the next vulnerability affects your stack