cbcvebase.
CVE-2008-2689
published 2008-06-13

CVE-2008-2689: PHP remote file inclusion vulnerability in pub/clients.php in BrowserCRM 5.002.00 allows remote attackers to execute arbitrary PHP code via a URL in the…

PriorityP261critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
46.19%
98.7th percentile
PHP remote file inclusion vulnerability in pub/clients.php in BrowserCRM 5.002.00 allows remote attackers to execute arbitrary PHP code via a URL in the bcrm_pub_root parameter.

Affected

1 ranges
VendorProductVersion rangeFixed in
browsercrmbrowsercrm——

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://www.gwebspace.de/mohsen/shell/r57.txt?↗
path/pub/clients.php↗
urlhttp://www.browsercrm.com/download/browsercrm-5.002.00.tar.gz↗
  • →Detect HTTP requests to clients.php containing a URL-valued bcrm_pub_root parameter, indicating remote file inclusion attempt. ↗
  • →Flag any GET/POST request where the bcrm_pub_root parameter value begins with http:// or https://, as this is the injectable parameter used to load a remote PHP shell. ↗
  • →The vulnerable code path is require_once($bcrm_pub_root . "/public_prepend.inc.php"); — monitor for inclusion of remote URLs via this construct in PHP logs or WAF telemetry. ↗
  • →Search engine dork can be used to identify exposed BrowserCRM instances: Copyright © 2007 BrowserCRM Ltd ↗
  • ·The RFI payload URL uses a trailing '?' to nullify the appended path suffix (/public_prepend.inc.php), a common RFI bypass technique that must be accounted for in detection signatures. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.