Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP code via a URL in the…

Published 17 y ago 2009-07-01 · modified 4 mo ago 2026-06-16 · JSON

CVSS

6.8

v2.0 · NVD

CISA KEV

not known exploited

EPSS

1.9%

percentile 80%

Public exploits

Exploit-DB

Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[pear_dir] parameter to (a) Mail/RFC822.php, (b) Net/Socket.php, (c) XML/Parser.php, (d) XML/Tree.php, (e) Mail/mimeDecode.php, (f) Console/Getopt.php, (g) System.php, (h) Log.php, and (i) File.php in includes/pear/; the CONFIG[pear_dir] parameter to (j) includes/prepend.php, and (k) includes/cachedConfig.php; and the (2) CONFIG[includes] parameter to (l) prepend.php and (m) email.list.search.php in includes/. NOTE: the CONFIG[pear_dir] parameter to includes/mailaccess/pop3.php is already covered by CVE-2006-2666.

Exploit prediction (EPSS)

1.94% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.

Exploits and detections

EDB-32036 V-Webmail 1.6.4 - '/includes/email.list.search.php?CONFIG[includes]' Remote File Inclusion · webapps · 2008-07-10
EDB-32035 V-Webmail 1.6.4 - '/includes/prepend.php?CONFIG[includes]' Remote File Inclusion · webapps · 2008-07-10
EDB-32034 V-Webmail 1.6.4 - '/includes/cachedConfig.php?CONFIG[pear_dir]' Remote File Inclusion · webapps · 2008-07-10
EDB-32033 V-Webmail 1.6.4 - '/includes/prepend.php?CONFIG[pear_dir]' Remote File Inclusion · webapps · 2008-07-10
EDB-32032 V-Webmail 1.6.4 - '/includes/pear/File.php?CONFIG[pear_dir]' Remote File Inclusion · webapps · 2008-07-10
EDB-32031 V-Webmail 1.6.4 - '/includes/pear/Log.php?CONFIG[pear_dir]' Remote File Inclusion · webapps · 2008-07-10
EDB-32030 V-Webmail 1.6.4 - '/includes/pear/System.php?CONFIG[pear_dir]' Remote File Inclusion · webapps · 2008-07-10
EDB-32029 V-Webmail 1.6.4 - '/includes/pear/Console/Getopt.php?CONFIG[pear_dir]' Remote File Inclusion · webapps · 2008-07-10
EDB-32028 V-Webmail 1.6.4 - '/includes/pear/Mail/mimeDecode.php?CONFIG[pear_dir]' Remote File Inclusion · webapps · 2008-07-10
EDB-32027 V-Webmail 1.6.4 - '/includes/pear/XML/Tree.php?CONFIG[pear_dir]' Remote File Inclusion · webapps · 2008-07-10
EDB-32026 V-Webmail 1.6.4 - '/includes/pear/XML/parser.php?CONFIG[pear_dir]' Remote File Inclusion · webapps · 2008-07-10
EDB-32025 V-Webmail 1.6.4 - '/includes/pear/Net/Socket.php?CONFIG[pear_dir]' Remote File Inclusion · webapps · 2008-07-10
EDB-32024 V-Webmail 1.6.4 - '/includes/pear/Mail/RFC822.php?CONFIG[pear_dir]' Remote File Inclusion · webapps · 2008-07-10

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

securityfocus.com /bid/30162 · vdb-entry, x_refsource_BID, x_transferred
packetstormsecurity.org /0807-exploits/vwebmail-rfi.txt · x_refsource_MISC, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/46680 · vdb-entry, x_refsource_XF, x_transferred

Sources

CVE List: CVE-2008-6840
NVD: CVE-2008-6840

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.