CVE-2008-2520

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.50%

Published

Jun 3, 2008

Modified

Jun 16, 2026

Public PoC / Exploit (2)

All weaponized →

TrickestTrickest PoC index Exploit-DBBigACE 2.4 - Multiple Remote File Inclusions

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple PHP remote file inclusion vulnerabilities in BigACE 2.4, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[_BIGACE][DIR][addon] parameter to (a) addon/smarty/plugins/function.captcha.php and (b) system/classes/sql/AdoDBConnection.php; and the (2) GLOBALS[_BIGACE][DIR][admin] parameter to (c) item_information.php and (d) jstree.php in system/application/util/, and (e) system/admin/plugins/menu/menuTree/plugin.php, different vectors than CVE-2006-4423.

Weaknesses (CWE)

CWE-94

Affected Products (1)

bigace · bigacevulnerable

References (8)

http://secunia.com/advisories/30183

PatchVendor Advisory

http://www.securityfocus.com/bid/29157

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/42343

https://www.exploit-db.com/exploits/5596

http://secunia.com/advisories/30183