CVE-2009-0517

Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary PHP code via the fields parameter, which is supplied to an eval function call within the generic function in include/class/tz_env.class. NOTE: some of these details are obtained from third party information.

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

48.88% chance of exploitation in the next 30 days, 99th percentile

Published

2009-02-11

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.securityfocus.com/archive/1/500664/100/0/threaded

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/7948

Security advisories

• http://secunia.com/advisories/33717
• http://www.securityfocus.com/bid/33572

References

• CVE Record
• NVD entry