CVE-2008-6305: PHP remote file inclusion vulnerability in init.php in Free Directory Script 1.1.1, when register_globals i...

Security readout for executives and security teams

CVE-2008-6305 affects Free Directory Script 1.1.1 in legacy PHP deployments where register_globals is enabled. An attacker could make the application load attacker-controlled PHP code through the API_HOME_DIR parameter, resulting in server-side code execution. The main business risk is compromise of old, internet-facing web properties still running this script. Exposure is likely limited to legacy sites running Free Directory Script 1.1.1 with register_globals enabled, especially if init.php is reachable from the internet. The bundle does not provide CPEs or broader affected-version evidence. Prioritize remediation if the organization still hosts this legacy PHP script publicly. The vulnerability enables code execution, but urgency is conditional because the affected software and register_globals setting are both old and may no longer be present. Mitigation focus: Identify any Free Directory Script 1.1.1 installations.; Disable PHP register_globals wherever present.; Restrict or remove public access to vulnerable legacy installations..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.