Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote aut…

published 2009-02-22 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-0673

cvss: 6.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.6%; EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits: 1; Exploit-DB

Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php.

Timeline

2009-02-16 First public exploit (EDB-8068)
2009-02-22 Published

Exploit prediction

2.65% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-8068 ravennuke 2.3.0 - Multiple Vulnerabilities webapps, 2009-02-16
waraxe.us http://www.waraxe.us/advisory-72.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

exploit-db.com /exploits/8068
exploit
waraxe.us /advisory-72.html
exploit
securityfocus.com /bid/33787
vdb-entry
ravenphpscripts.com /postt17156.html
exchange.xforce.ibmcloud.com /vulnerabilities/48790
vdb-entry
securityfocus.com /archive/1/500988/100/0/threaded
mailing-list

Sources

CVE List CVE-2009-0673
NVD CVE-2009-0673

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary