CVE-2008-6928

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

Unrestricted file upload vulnerability in PHPStore Complete Classifieds allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a logo, then accessing it via a direct request to the file in classifieds1/yellow_images/.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/50294
http://secunia.com/advisories/32626Vendor Advisory
http://www.vupen.com/english/advisories/2008/3100Vendor Advisory
https://www.exploit-db.com/exploits/7084
http://osvdb.org/50294
http://secunia.com/advisories/32626Vendor Advisory
http://www.vupen.com/english/advisories/2008/3100Vendor Advisory
https://www.exploit-db.com/exploits/7084

Timeline

Published: Aug 11, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-69296.5Unrestricted file upload vulnerability in PHPStore Auto Classifieds allows remote authenticated users to execute arbitrary code by uploading CVE-2008-69306.5Unrestricted file upload vulnerability in PHPStore Real Estate allows remote authenticated users to execute arbitrary code by uploading a fi CVE-2008-69316.5Unrestricted file upload vulnerability in PHPStore Job Search (aka PHPCareers) allows remote authenticated users to execute arbitrary code b CVE-2008-69327.5Unrestricted file upload vulnerability in submit_file.php in AlstraSoft SendIt Pro allows remote attackers to execute arbitrary code by uplo CVE-2008-69335.0Directory traversal vulnerability in index.php in MiniGal b13 (aka MG2) allows remote attackers to read the source code of .php files, and p CVE-2008-69347.5Static code injection vulnerability in Sanus|artificium (aka Sanusart) Free simple guestbook PHP script, when downloaded before 20081111, al CVE-2008-693510.0Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary file CVE-2008-69369.3Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary file CVE-2008-693710.0Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary file CVE-2008-69384.3Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote att CVE-2008-69397.5TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileges by setting the ad CVE-2008-69407.5TurnkeyForms Web Hosting Directory stores sensitive information under the web root with insufficient access control, which allows remote att