CVE-2008-2638
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote...
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitrary PHP code via the message parameter in an HTML webform, which is written to data.php.
Exploit likelihood
What each source reports
NVD Score used
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitrary PHP code via the message parameter in an HTML webform, which is written to data.php.
- Record
CVE-2008-2638- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitrary PHP code via the message parameter in an HTML webform, which is written to data.php.
- Record
CVE-2008-2638- Updated
- 2026-11-02
EUVDEUVD-2008-2633 No score
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitrary PHP code via the message parameter in an HTML webform, which is written to data.php.
- Record
EUVD-2008-2633- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-23r2-7v4m-m7mp No score
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote...
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitrary PHP code via the message parameter in an HTML webform, which is written to data.php.
- Record
GHSA-23r2-7v4m-m7mp- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | 1Book Guestbook Script 1.0.1 - Code Execution | 2008-06-03 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2638 is a high vulnerability (CVSS 10.0) in 1-script 1-book, published June 10, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.86%, the 90th percentile. No source names a fixed version.