Skip to content
Fencer Vulns
medium 6.8

CVE-2008-6840 json

Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP code via a URL in the…

published 2009-07-01 17 y ago modified 2026-06-16 4 mo ago also EUVD-2008-6800

cvss
6.8
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 80%
public exploits
13
Exploit-DB

Summary

Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[pear_dir] parameter to (a) Mail/RFC822.php, (b) Net/Socket.php, (c) XML/Parser.php, (d) XML/Tree.php, (e) Mail/mimeDecode.php, (f) Console/Getopt.php, (g) System.php, (h) Log.php, and (i) File.php in includes/pear/; the CONFIG[pear_dir] parameter to (j) includes/prepend.php, and (k) includes/cachedConfig.php; and the (2) CONFIG[includes] parameter to (l) prepend.php and (m) email.list.search.php in includes/. NOTE: the CONFIG[pear_dir] parameter to includes/mailaccess/pop3.php is already covered by CVE-2006-2666.

Timeline

  1. First public exploit (EDB-32036)
  2. Published

Exploit prediction

1.94% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-32036 V-Webmail 1.6.4 - '/includes/email.list.search.php?CONFIG[includes]' Remote File Inclusion webapps, 2008-07-10
  • EDB-32035 V-Webmail 1.6.4 - '/includes/prepend.php?CONFIG[includes]' Remote File Inclusion webapps, 2008-07-10
  • EDB-32034 V-Webmail 1.6.4 - '/includes/cachedConfig.php?CONFIG[pear_dir]' Remote File Inclusion webapps, 2008-07-10
  • EDB-32033 V-Webmail 1.6.4 - '/includes/prepend.php?CONFIG[pear_dir]' Remote File Inclusion webapps, 2008-07-10
  • EDB-32032 V-Webmail 1.6.4 - '/includes/pear/File.php?CONFIG[pear_dir]' Remote File Inclusion webapps, 2008-07-10
  • EDB-32031 V-Webmail 1.6.4 - '/includes/pear/Log.php?CONFIG[pear_dir]' Remote File Inclusion webapps, 2008-07-10
  • EDB-32030 V-Webmail 1.6.4 - '/includes/pear/System.php?CONFIG[pear_dir]' Remote File Inclusion webapps, 2008-07-10
  • EDB-32029 V-Webmail 1.6.4 - '/includes/pear/Console/Getopt.php?CONFIG[pear_dir]' Remote File Inclusion webapps, 2008-07-10
  • EDB-32028 V-Webmail 1.6.4 - '/includes/pear/Mail/mimeDecode.php?CONFIG[pear_dir]' Remote File Inclusion webapps, 2008-07-10
  • EDB-32027 V-Webmail 1.6.4 - '/includes/pear/XML/Tree.php?CONFIG[pear_dir]' Remote File Inclusion webapps, 2008-07-10
  • EDB-32026 V-Webmail 1.6.4 - '/includes/pear/XML/parser.php?CONFIG[pear_dir]' Remote File Inclusion webapps, 2008-07-10
  • EDB-32025 V-Webmail 1.6.4 - '/includes/pear/Net/Socket.php?CONFIG[pear_dir]' Remote File Inclusion webapps, 2008-07-10
  • EDB-32024 V-Webmail 1.6.4 - '/includes/pear/Mail/RFC822.php?CONFIG[pear_dir]' Remote File Inclusion webapps, 2008-07-10
  • securityfocus.com http://www.securityfocus.com/bid/30162 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.org http://packetstormsecurity.org/0807-exploits/vwebmail-rfi.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.