CVE-2008-3239

Status: ModifiedHigh (9.3)—Exploit

Severity9.3High · CVSS 2.0

Exploitation probability5.17 %higher than 92% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailablePublished on Exploit-DB

Unrestricted file upload vulnerability in the writeLogEntry function in system/v_cron_proc.php in PHPizabi 0.848b C1 HFP1, when register_globals is enabled, allows remote attackers to upload and execute arbitrary code via a filename in the CONF[CRON_LOGFILE] parameter and file contents in the CONF[LOCALE_LONG_DATE_TIME] parameter.

CVSS

Base score: 9.3
Version: 2.0
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 5.17 %
Percentile among all scored CVEs: 92
Score date: 10/22/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Published on Exploit-DB · PHPizabi 0.848b C1 HFP1 - Remote Code Execution (7/16/2008)

Affected technologies (1)

Phpizabi — Phpizabi

CWEs

CWE-20

References

Show 10 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2008-3239",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-07-21T16:41:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/31127",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/4022",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/30257",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43856",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6085",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/31127",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/4022",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/30257",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43856",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6085",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted file upload vulnerability in the writeLogEntry function in system/v_cron_proc.php in PHPizabi 0.848b C1 HFP1, when register_globals is enabled, allows remote attackers to upload and execute arbitrary code via a filename in the CONF[CRON_LOGFILE] parameter and file contents in the CONF[LOCALE_LONG_DATE_TIME] parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de subida de ficheros sin restricción en la Función writeLogEntry en system/v_cron_proc.php de PHPizabi 0.848b C1 HFP1, cuando register_globals están activadas, permite a atacantes remotos subir y ejecutar código de su elección a través de un nombre de fichero en los parámetros CONF[CRON_LOGFILE] y CONF[LOCALE_LONG_DATE_TIME]."
    }
  ],
  "lastModified": "2026-06-16T22:55:26.687",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpizabi:phpizabi:0.848b:c1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "105C8961-BDEC-4C5D-B45C-644BC6E388C3"
            },
            {
              "criteria": "cpe:2.3:a:phpizabi:phpizabi:0.848b:c1_hfp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5611CEF-920E-4FFF-95CF-2612FF713D10"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}