CVE-2008-2018 | BDVDB-2026-30456 Detail

Description#

The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings delimited by '{' and '}' characters, which allows remote authenticated users to obtain sensitive information via a comment containing a macro, as demonstrated by a "{user.password}" comment in the profile of the admin user.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12008-04-30Record published in the CVE List.
2. Version 22024-08-07Most recent update recorded in the CVE List.