CVE-2008-2877: PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when register_...

Security readout for executives and security teams

This is an old remote code execution risk in cmsWorks 2.2 RC4. If the vulnerable PHP configuration is enabled, an attacker may make the application load attacker-controlled PHP code. The source bundle does not provide a patch, CVSS score, or evidence of active exploitation. Exposure is most likely limited to legacy cmsWorks 2.2 RC4 deployments, especially internet-facing sites with the admin path reachable and register_globals enabled. The structured affected-product metadata is incomplete, so asset validation is necessary. Prioritize validation for any legacy public web systems. If cmsWorks 2.2 RC4 is present, treat it as urgent because successful exploitation could allow server-side code execution. Mitigation focus: Identify and retire or upgrade any cmsWorks 2.2 RC4 installations.; Disable register_globals wherever this legacy PHP setting exists.; Restrict public access to the cmsWorks admin directory..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.