CVE-2008-5090

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-11-14 · updated 2026-06-16
Weakness: CWE-94

Description

Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the email parameter, which is processed by the preg_replace function with the eval switch.

Affected products

Anelectron Advanced Electron Forum: through 1.0.6; 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5

References

http://secunia.com/advisories/31978
http://securityreason.com/securityalert/4598
http://www.anelectron.com/board/index.php?tid=3282
http://www.gulftech.org/?node=research&article_id=00131-09202008
http://www.securityfocus.com/archive/1/496552/100/0/threaded
http://www.securityfocus.com/bid/31268
https://exchange.xforce.ibmcloud.com/vulnerabilities/45270
https://www.exploit-db.com/exploits/6499
http://secunia.com/advisories/31978
http://securityreason.com/securityalert/4598
http://www.anelectron.com/board/index.php?tid=3282
http://www.gulftech.org/?node=research&article_id=00131-09202008

Get alerted when CVE-2008-5090 or the next vulnerability affects your stack