CVE-2008-3399: PHP remote file inclusion vulnerability in activities/workflow-activities.php in XRMS CRM 1.99.2, when regi...

Security readout for executives and security teams

This is an old XRMS CRM 1.99.2 issue that can let an internet attacker run PHP code on the server if a risky PHP setting, register_globals, is enabled. Business risk is highest for legacy, forgotten CRM deployments still exposed online. Exposure appears limited to XRMS CRM 1.99.2 systems where activities/workflow-activities.php is reachable and PHP register_globals is enabled. Modern PHP environments are less likely to have this setting, but legacy systems may still be vulnerable. Prioritize if XRMS CRM is still used or internet-facing. This can become server compromise, but urgency depends on whether the legacy version and PHP setting are present. Mitigation focus: Inventory any XRMS CRM deployments and confirm whether version 1.99.2 is present.; Disable PHP register_globals wherever it remains enabled.; Restrict or remove internet access to vulnerable XRMS instances until remediated..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.