CVE-2008-0289

PHP remote file inclusion vulnerability in view_func.php in Member Area System (MAS) 1.7 and possibly others allows remote attackers to execute arbitrary PHP code via a URL in the i parameter. NOTE: a second vector might exist via the l parameter. NOTE: as of 20080118, the vendor has disputed the set of affected versions, stating that the issue "is already fixed, for almost a year."

• CWE-94

• http://securityreason.com/securityalert/3547
• http://www.securityfocus.com/archive/1/486172/100/0/threaded
• http://www.securityfocus.com/archive/1/486618/100/0/threaded
• http://www.securityfocus.com/bid/27244
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39611
• http://securityreason.com/securityalert/3547
• http://www.securityfocus.com/archive/1/486172/100/0/threaded
• http://www.securityfocus.com/archive/1/486618/100/0/threaded
• http://www.securityfocus.com/bid/27244
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39611

Published

Jan 16, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-0283PHP remote file inclusion vulnerability in /aides/index.php …
• CVE-2008-0284Cross-site scripting (XSS) vulnerability in Simple Machines …
• CVE-2008-0285ngIRCd 0.10.x before 0.10.4 and 0.11.0 before 0.11.0-pre2 al…
• CVE-2008-0286SQL injection vulnerability in admin/login.php in Article Da…
• CVE-2008-0287PHP remote file inclusion vulnerability in VisionBurst vcart…
• CVE-2008-0288Multiple SQL injection vulnerabilities in ImageAlbum 2.0.0b2…
• CVE-2008-0290Multiple SQL injection vulnerabilities in Digital Hive 2.0 R…
• CVE-2008-0291SQL injection vulnerability in showproduct.asp in RichStrong…
• CVE-2008-0292Cross-site scripting (XSS) vulnerability in photo_album.pl i…
• CVE-2008-0293Unspecified vulnerability in cron.php in FreeSeat before 1.1…
• CVE-2008-0294Unspecified vulnerability in the seat-locking implementation…
• CVE-2008-0295Heap-based buffer overflow in modules/access/rtsp/real_sdppl…