CVE-2008-1124 EXPLOIT
6.8
MEDIUM · CVSS 2.0 · EPSS 21.5% (pctl 98)
Patch early
A public exploit exists.
Description
Multiple PHP remote file inclusion vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absoluteurl parameter to (1) components/xmlparser/loadparser.php; (2) admin.php, (3) categories.php, (4) categories_add.php, (5) categories_remove.php, (6) edit.php, (7) editdel.php, (8) ftpfeature.php, (9) login.php, (10) pgRSSnews.php, (11) showcat.php, and (12) upload.php in core/admin/; and (13) archive_cat.php, (14) archive_nocat.php, and (15) recent_list.php in core/.
Scoring
| CVSS | 6.8 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| EPSS | 21.53% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-94 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2008-03-03 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| podcast generator | podcast generator |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Podcast Generator 1.0 Beta 2 - Remote File Inclusion / File Disclosure | 2008-02-28 |
References
→ the Explorer · watch your stack · NVD