Eval injection vulnerability in Megacubo 5.0.7 allows remote attackers to inject and execute arbitrary PHP code via the play action in a me…

Exploit prediction (EPSS)

3.74% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

Exploits and detections

• EDB-7630 Megacubo 5.0.7 - 'mega://' Arbitrary File Download and Execute · remote · 2009-01-01
• EDB-7623 Megacubo 5.0.7 - 'mega://' Remote 'eval()' Injection · remote · 2008-12-30

CVSS scores

Classification

Weakness

• CWE-94 Improper Control of Generation of Code

References

• securityfocus.com /bid/33062 · vdb-entry, x_refsource_BID, x_transferred
• secunia.com /advisories/33326 · third-party-advisory, x_refsource_SECUNIA, x_transferred
• retrogod.altervista.org /9sg_megacubo.html · x_refsource_MISC, x_transferred
• securityfocus.com /archive/1/499654/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
• exchange.xforce.ibmcloud.com /vulnerabilities/47697 · vdb-entry, x_refsource_XF, x_transferred
• exploit-db.com /exploits/7623 · exploit, x_refsource_EXPLOIT-DB, x_transferred
• osvdb.org /51106 · vdb-entry, x_refsource_OSVDB, x_transferred

Sources

• CVE List: CVE-2008-6748
• NVD: CVE-2008-6748

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.