CVE-2008-6132: Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is d...

Security readout for executives and security teams

CVE-2008-6132 affects old phpScheduleIt deployments. If phpScheduleIt 1.2.10 or earlier is exposed and magic_quotes_gpc is disabled, a remote attacker could cause the application to run attacker-supplied PHP code through a reservation date field. Exposure is likely limited to legacy phpScheduleIt 1.2.10 and earlier installations, especially internet-facing reservation systems running older PHP configurations with magic_quotes_gpc disabled. Treat this as urgent for any remaining legacy deployment. Remote code execution in a web application can lead to full application compromise, but priority depends on whether phpScheduleIt is still present and exposed. Mitigation focus: Identify and retire phpScheduleIt 1.2.10 and earlier deployments.; Review vendor 1.2.11 release notes and apply the vendor-supported update path.; Restrict external access to legacy scheduling systems until remediated..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.