CVE-2008-6132

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 26.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-02-13 · updated 2026-06-16
Weakness: CWE-94

Description

Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via the start_date parameter.

Affected products

Brickhost Phpscheduleit: through 1.2.10; 1.0, 1.0.0rc1, 1.0_rc1, 1.2.0, 1.2.0-beta, 1.2.0-rc1 (+9)

References

http://phpscheduleit.svn.sourceforge.net/viewvc/phpscheduleit/1.2.11/reserve.php?r1=318&r2=328
http://secunia.com/advisories/32073
http://sourceforge.net/project/shownotes.php?release_id=662749
http://www.exploit-db.com/exploits/18037
http://www.exploit-db.com/exploits/6646
http://www.osvdb.org/48797
http://www.securityfocus.com/bid/31520
https://exchange.xforce.ibmcloud.com/vulnerabilities/45617
http://phpscheduleit.svn.sourceforge.net/viewvc/phpscheduleit/1.2.11/reserve.php?r1=318&r2=328
http://secunia.com/advisories/32073
http://sourceforge.net/project/shownotes.php?release_id=662749
http://www.exploit-db.com/exploits/18037

Get alerted when CVE-2008-6132 or the next vulnerability affects your stack