« Volver al listado

CVE-2008-3763

Estado: ModificadaMedia (6.8)—

Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier, when register_globals is enabled, allows remote attackers to overwrite arbitrary variables related to the db config file. NOTE: this can be leveraged for code injection by overwriting the language file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Turnkeywebtools — PHP Live Helper

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-3763",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-08-21T17:41:00.000",
  "references": [
    {
      "url": "http://demos.turnkeywebtools.com/phplivehelper/docs/change_log.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/31521",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/4178",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.gulftech.org/?node=research&article_id=00124-08162008",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/495542/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/30729",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44570",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6261",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://demos.turnkeywebtools.com/phplivehelper/docs/change_log.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/31521",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/4178",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.gulftech.org/?node=research&article_id=00124-08162008",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/495542/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/30729",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44570",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6261",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier, when register_globals is enabled, allows remote attackers to overwrite arbitrary variables related to the db config file.  NOTE: this can be leveraged for code injection by overwriting the language file."
    },
    {
      "lang": "es",
      "value": "vulnerabilidad de variable sobrescrita en libsecure.php de Turnkey PHP Live Helper 2.0.1 y versiones anteriores, cuando register_globals está activo, permite a atacantes remotos sobrescribir variables de su elección relacionadas com el fichero de configuración db.\r\nNOTA: esto puede ser aprovechado para inyección de código sobrescribiendo el fichero language."
    }
  ],
  "lastModified": "2026-06-16T22:56:29.710",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:turnkeywebtools:php_live_helper:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7955136-21D9-43D2-8FC3-F929BB8C74AF",
              "versionEndIncluding": "2.0.1"
            },
            {
              "criteria": "cpe:2.3:a:turnkeywebtools:php_live_helper:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "824C4B8A-4A58-465E-9AD0-92AC3CCE01D6"
            },
            {
              "criteria": "cpe:2.3:a:turnkeywebtools:php_live_helper:2.0:beta_1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47FAC4AC-BCED-4469-AF56-B0FF3FA47EC5"
            },
            {
              "criteria": "cpe:2.3:a:turnkeywebtools:php_live_helper:2.0:beta_2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E0355DB-27CE-4107-A12F-E65D9E3936E3"
            },
            {
              "criteria": "cpe:2.3:a:turnkeywebtools:php_live_helper:2.0:beta_3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DB7C1FE-6A6C-4017-943C-C1BD7B9F141E"
            },
            {
              "criteria": "cpe:2.3:a:turnkeywebtools:php_live_helper:2.0:beta_4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "017BA6C7-ADDD-4130-AD25-9AD26B9E2BB8"
            },
            {
              "criteria": "cpe:2.3:a:turnkeywebtools:php_live_helper:2.0:beta_5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA4A9A64-A16B-485D-8451-C3271F1E0417"
            },
            {
              "criteria": "cpe:2.3:a:turnkeywebtools:php_live_helper:2.0:beta_6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED67C8B9-9CEA-4E60-8364-53D280375D64"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "evaluatorSolution": "Upgrade to Version 2.1.0 - http://www.turnkeywebtools.com/esupport/index.php?_m=news&_a=viewnews&newsid=62"
}