VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 23, 2008· Updated Jun 16, 2026

CVE-2008-4304

CVE-2008-4304

Description

general/login.php in phpCollab 2.5 rc3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSL_CLIENT_CERT environment variable. NOTE: in some environments, SSL_CLIENT_CERT always has a base64-encoded string value, which may impose constraints on injection for typical shells.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

8
  • PHP Collab/Phpcollab8 versions
    cpe:2.3:a:phpcollab:phpcollab:2.2:*:*:*:*:*:*:*+ 7 more
    • cpe:2.3:a:phpcollab:phpcollab:2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:phpcollab:phpcollab:2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:phpcollab:phpcollab:2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:phpcollab:phpcollab:2.5:beta_4:*:*:*:*:*:*
    • cpe:2.3:a:phpcollab:phpcollab:2.5:rc1:*:*:*:*:*:*
    • cpe:2.3:a:phpcollab:phpcollab:2.5:rc2:*:*:*:*:*:*
    • cpe:2.3:a:phpcollab:phpcollab:*:rc3:*:*:*:*:*:*range: <=2.5
    • (no CPE)range: <=2.5 rc3

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.