cbcvebase.
CVE-2008-4645
published 2008-10-22

CVE-2008-4645: plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to execute arbitrary PHP code via PHP…

PriorityP352critical9CVSS 2.0
AVNACLAuSCCICAC
EXPLOIT
EPSS
7.12%
93.5th percentile
plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to execute arbitrary PHP code via PHP sequences in the sort parameter, which is processed by create_function.

Affected

19 ranges
VendorProductVersion rangeFixed in
phpwebgalleryphpwebgallery<= 1.7.2—
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
phpwebgalleryphpwebgallery——
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.