CVE-2008-6840

V-webmail 1.6.4 - Remote File Inclusion via CONFIG[pear_dir] or CONFIG[includes] Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 13 public exploits for CVE-2008-6840. PoCs published by CraCkEr.

AI-analyzed exploit summary The code describes a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data in the 'CONFIG[pear_dir]' parameter. Exploitation could lead to arbitrary code execution or other attacks.

Description

Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[pear_dir] parameter to (a) Mail/RFC822.php, (b) Net/Socket.php, (c) XML/Parser.php, (d) XML/Tree.php, (e) Mail/mimeDecode.php, (f) Console/Getopt.php, (g) System.php, (h) Log.php, and (i) File.php in includes/pear/; the CONFIG[pear_dir] parameter to (j) includes/prepend.php, and (k) includes/cachedConfig.php; and the (2) CONFIG[includes] parameter to (l) prepend.php and (m) email.list.search.php in includes/. NOTE: the CONFIG[pear_dir] parameter to includes/mailaccess/pop3.php is already covered by CVE-2006-2666.

Exploits (13)

exploitdb WRITEUP VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32033

The code describes a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data in the 'CONFIG[pear_dir]' parameter. Exploitation could lead to arbitrary code execution or other attacks.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Network access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32035

The code describes a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data in the 'CONFIG[includes]' parameter. Exploitation could lead to remote code execution by including malicious files from external sources.

Classification
Writeup 80%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Access to the vulnerable endpoint · Ability to host a malicious file on an external server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32027

The provided text describes a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data. It includes a sample exploit URL but lacks executable code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Network access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32026

The provided text describes a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data. It includes a sample exploit URL but lacks executable code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Network access to the target application · Ability to host malicious files on an external server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32030

The provided text describes a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data. It includes a sample exploit URL but lacks executable code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Network access to the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32025

The provided text describes a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data. The example URL demonstrates how an attacker could exploit this by injecting a malicious external URL into the 'CONFIG[pear_dir]' parameter.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Access to the vulnerable endpoint · Ability to craft a malicious URL
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32024

The code describes a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data. The example URL demonstrates how an attacker could exploit this by injecting a malicious remote path into the 'CONFIG[pear_dir]' parameter.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Access to the vulnerable endpoint · Ability to host malicious files on a remote server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32028

This exploit demonstrates a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied input in the 'CONFIG[pear_dir]' parameter. An attacker can include arbitrary remote files, potentially leading to remote code execution.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Network access to the target application · Ability to host a malicious file on a remote server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32031

The provided text describes a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data. The example URL demonstrates how an attacker could exploit this by injecting a malicious external URL into the 'CONFIG[pear_dir]' parameter.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Access to the vulnerable endpoint · Ability to craft a malicious URL
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32032

The provided text describes a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data. It includes a sample exploit URL but lacks executable code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Network access to the target application · Ability to craft malicious URLs
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32029

This exploit demonstrates a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data in the 'CONFIG[pear_dir]' parameter. An attacker can include arbitrary remote files, potentially leading to remote code execution.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Network access to the target application · Ability to host a malicious file on a remote server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32036

This exploit demonstrates a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data in the 'CONFIG[includes]' parameter. An attacker can include and execute arbitrary remote files, potentially leading to remote code execution.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Remote file inclusion must be enabled on the target server · Attacker must be able to host a malicious file on a remote server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by CraCkEr · textwebappsphp
https://www.exploit-db.com/exploits/32034

The code describes a remote file inclusion vulnerability in V-webmail 1.6.4 due to insufficient sanitization of user-supplied data in the 'CONFIG[pear_dir]' parameter. Exploitation could allow an attacker to include remote files, potentially leading to arbitrary code execution.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: V-webmail 1.6.4
No auth needed
Prerequisites: Access to the vulnerable endpoint · Ability to host a malicious file on a remote server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/30162
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/46680

Scores

EPSS 0.0194
EPSS Percentile 77.4%

Details

CWE
CWE-94
Status published
Products (1)
christof_bruyland/v-webmail 1.6.4
Published Jul 01, 2009
Tracked Since Feb 18, 2026