CVE-2008-3167: Multiple PHP remote file inclusion vulnerabilities in BoonEx Dolphin 6.1.2, when register_globals is enable...

Security readout for executives and security teams

This is an old remote file inclusion issue affecting BoonEx Dolphin 6.1.2 when PHP register_globals is enabled. A remote attacker could cause the application to load attacker-controlled PHP, leading to code execution. Exposure is most relevant for legacy, internet-facing PHP sites still running this version or bundled SafeHTML/Ray components. Likely limited to legacy BoonEx Dolphin 6.1.2 deployments with register_globals enabled. Internet-facing installations carry the most business risk. Modern PHP environments usually lack register_globals, but old hosted applications and abandoned community sites should be checked. Prioritize if any legacy Dolphin 6.1.2 site is internet-facing. Successful exploitation could become server-side code execution. If no such legacy deployment exists, business urgency is low, but asset inventory should confirm that assumption. Mitigation focus: Identify and retire or upgrade any BoonEx Dolphin 6.1.2 deployments.; Disable register_globals on any legacy PHP runtime where it still exists.; Check BoonEx or archived vendor guidance for fixed versions or patches..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.