CVE-2008-3770

Multiple directory traversal vulnerabilities in Freeway 1.4.1.171, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter to (1) includes/events_application_top.php; (2) english/account.php, (3) french/account.php, and (4) french/account_newsletters.php in includes/languages/; (5) includes/modules/faqdesk/faqdesk_article_require.php; (6) includes/modules/newsdesk/newsdesk_article_require.php; (7) card1.php, (8) loginbox.php, and (9) whos_online.php in templates/Freeway/boxes/; and (10) templates/Freeway/mainpage_modules/mainpage.php. NOTE: vector 1 may be the same as CVE-2008-3677.

• CWE-22

• http://secunia.com/advisories/31475Vendor Advisory
• http://securityreason.com/securityalert/4181
• http://www.openfreeway.org/download/change-log.html
• http://www.securityfocus.com/archive/1/495549/100/0/threaded
• http://www.securityfocus.com/bid/30731Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45037
• http://secunia.com/advisories/31475Vendor Advisory
• http://securityreason.com/securityalert/4181
• http://www.openfreeway.org/download/change-log.html
• http://www.securityfocus.com/archive/1/495549/100/0/threaded
• http://www.securityfocus.com/bid/30731Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45037

Published

Aug 22, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-3764Eval injection vulnerability in globalsoff.php in Turnkey PH…
• CVE-2008-3765SQL injection vulnerability in code.php in Quick Poll Script…
• CVE-2008-3766Realtime Internet Band Rehearsal Low-Latency (Internet) Conn…
• CVE-2008-3767SQL injection vulnerability in classified.php in phpBazar 2.…
• CVE-2008-3768Multiple SQL injection vulnerabilities in class.ajax.php in …
• CVE-2008-3769PHP remote file inclusion vulnerability in admin/create_orde…
• CVE-2008-3771Cross-site scripting (XSS) vulnerability in members.php in P…
• CVE-2008-3772SQL injection vulnerability in categories_portal.php in Pars…
• CVE-2008-3773Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 …
• CVE-2008-3774SQL injection vulnerability in index.php in Simasy CMS allow…
• CVE-2008-3775Folder Lock 5.9.5 and earlier uses weak encryption (ROT-25) …4.4
• CVE-2008-3776Directory traversal vulnerability in Fujitsu Web-Based Admin…