$ cve CVE-2008-2520 JSON

CVE-2008-2520 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 2.5% (pctl 84)

Patch early

A public exploit exists.

Description

Multiple PHP remote file inclusion vulnerabilities in BigACE 2.4, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[_BIGACE][DIR][addon] parameter to (a) addon/smarty/plugins/function.captcha.php and (b) system/classes/sql/AdoDBConnection.php; and the (2) GLOBALS[_BIGACE][DIR][admin] parameter to (c) item_information.php and (d) jstree.php in system/application/util/, and (e) system/admin/plugins/menu/menuTree/plugin.php, different vectors than CVE-2006-4423.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	2.51% — more likely to be exploited than 84% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	yes
Published	2008-06-03
Last modified	2026-06-16

Affected (1)

Vendor	Product
bigace	bigace

Public exploits

Source	Title	Date
exploit-db	BigACE 2.4 - Multiple Remote File Inclusions	2008-05-12

References

→ the Explorer · watch your stack · NVD