CVE-2008-2018

Status: ModifiedMedium (4)—Exploit

Severity4Medium · CVSS 2.0

Exploitation probability2.16 %higher than 82% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailablePublished on Exploit-DB

The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings delimited by '{' and '}' characters, which allows remote authenticated users to obtain sensitive information via a comment containing a macro, as demonstrated by a "{user.password}" comment in the profile of the admin user.

CVSS

Base score: 4
Version: 2.0
Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 2.16 %
Percentile among all scored CVEs: 82
Score date: 10/22/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Published on Exploit-DB · PHPizabi 0.848b C1 HFP3 - Database Information Disclosure (4/26/2008)

Affected technologies (1)

Phpizabi — Phpizabi

CWEs

CWE-200

References

Show 6 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2008-2018",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-04-30T01:07:00.000",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/28954",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42143",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/5506",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/28954",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42143",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/5506",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings delimited by '{' and '}' characters, which allows remote authenticated users to obtain sensitive information via a comment containing a macro, as demonstrated by a \"{user.password}\" comment in the profile of the admin user."
    },
    {
      "lang": "es",
      "value": "La función AssignUser en template.class.php de PHPizabi 0.848b C1 HFP3 realiza macro expansiones peligrosas en cadenas delimitadas por caracteres '{' y '}', que permiten a atacantes remotamente autentificados obtener información sensible mediante un comentario que contiene un macro, como se demostró con un comentario \"{user.password}\" en el perfil del usuario admin."
    }
  ],
  "lastModified": "2026-06-16T22:52:56.827",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpizabi:phpizabi:0.848b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FBF85FD-A330-4543-9AEC-16790850ED6D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}