Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

KTorrent web interface can run attacker code

CVE-2008-5906 · published 17 years ago
Summary

The web interface plugin in KTorrent versions before 3.1.4 lets an attacker send specially crafted requests that cause the server to run any PHP code they choose. This could let the attacker take control of the server hosting the application. Update KTorrent to version 3.1.4 or later, or remove/disable the web interface plugin until you can upgrade.

What to do
  • Update debian ktorrent to version 3.1.4+dfsg.1-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian ktorrent < 3.1.4+dfsg.1-1
Fix: upgrade to 3.1.4+dfsg.1-1
Debian:13 debian ktorrent < 3.1.4+dfsg.1-1
Fix: upgrade to 3.1.4+dfsg.1-1
Debian:14 debian ktorrent < 3.1.4+dfsg.1-1
Fix: upgrade to 3.1.4+dfsg.1-1
– ktorrent ktorrent <= 3.1.3
0.9
1.0
1.1
1.2
2.0
2.0.1
2.0.2
2.0.3
2.1
2.1.1
2.1.2
17 more version ranges
cpe:2.3:a:ktorrent:ktorrent:*:*:*:*:*:*:*:*
Original advisory text
Eval injection vulnerability in the web interface plugin in KTorrent before 3.1.4 allows remote attackers to execute arbitrary PHP code via unspecified parameters to this interface's PHP scripts.
Eval injection vulnerability in the web interface plugin in KTorrent before 3.1.4 allows remote attackers to execute arbitrary PHP code via unspecified parameters to this interface's PHP scripts.
References
Severity
6.8 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published15 Jan 2009
Updated4 Nov 2026
First seen20 Sep 2026
Sources
DEBIAN-CVE-2008-5906 · OSV
CVE-2008-5906 · NVD
Track software like this
Free during beta