CVE-2008-2018

Published: Apr 30, 2008Modified: Apr 23, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings delimited by '{' and '}' characters, which allows remote authenticated users to obtain sensitive information via a comment containing a macro, as demonstrated by a "{user.password}" comment in the profile of the admin user.

Affected (1)

Products: Phpizabi: Phpizabi

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Phpizabi Phpizabi	Version 0.848b

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

http://www.securityfocus.com/bid/28954

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/42143

Source: cve@mitre.org

https://www.exploit-db.com/exploits/5506

Source: cve@mitre.org

http://www.securityfocus.com/bid/28954

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/42143

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/5506

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.