Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

PHPCow could let attackers run code on your server

CVE-2008-5227 · published 17 years ago
Summary

A weakness in the PHPCow software lets a remote attacker make the server execute any code they choose, potentially taking control of the site. This type of attack has been observed in the wild. Apply any available updates, disable the vulnerable feature, or replace PHPCow with a secure alternative.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
phpcow phpcow All versions
cpe:2.3:a:phpcow:phpcow:*:*:*:*:*:*:*:*
Original advisory text
Unspecified vulnerability in PHPCow allows remote attackers to execute arbitrary code via unknown vectors, related to a "file inclusion vulnerability," as exploited in the wild in November 2008.
Unspecified vulnerability in PHPCow allows remote attackers to execute arbitrary code via unknown vectors, related to a "file inclusion vulnerability," as exploited in the wild in November 2008.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
5% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published25 Nov 2008
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-5227 · NVD
Track software like this
Free during beta