CVE-2008-3298

SocialEngine < 2.81 - Authenticated PHP Code Injection via Template Write Privileges

Title source: manual
STIX 2.1

Description

SocialEngine (SE) before 2.83 grants certain write privileges for templates, which allows remote authenticated administrators to execute arbitrary PHP code.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/43959
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/494638/100/0/threaded
Patch x_refsource_confirm
http://www.socialengine.net/news.php
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/4035
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31203

Scores

EPSS 0.0148
EPSS Percentile 70.8%

Details

CWE
CWE-94
Status published
Products (12)
social_engine/social_engine 1.0
social_engine/social_engine 1.1
social_engine/social_engine 1.4
social_engine/social_engine 1.6
social_engine/social_engine 1.7
social_engine/social_engine 1.8
social_engine/social_engine 2.0 (2 CPE variants)
social_engine/social_engine 2.1
social_engine/social_engine 2.4
social_engine/social_engine 2.5
... and 2 more
Published Jul 25, 2008
Tracked Since Feb 18, 2026