Security readout for executives and security teams
Plain-English summary
This CVE describes an old Telephone Directory 2008 flaw where a remote request to del_query1.php with a changed id can delete contacts. Business impact is integrity and availability of directory data, not code execution. The bundle includes a public exploit reference but no KEV listing, CVSS score, vendor patch, or confirmed active exploitation.
Executive priority
Prioritize discovery over emergency response. This is an old, destructive web flaw with a public exploit reference, but the supplied evidence does not show active exploitation or broad modern exposure.
Technical view
del_query1.php accepts an id variable used to select a contact for deletion. Sources describe insufficient protection around that operation, allowing remote deletion of arbitrary contacts by direct request with a modified id. The record lacks CVSS, CWE, CPE, and version detail beyond Telephone Directory 2008.
Likely exposure
Exposure is likely limited to organizations still running Telephone Directory 2008, especially if del_query1.php is reachable from untrusted networks. The source bundle does not provide CPEs, deployment patterns, or affected version ranges.
Exploitation context
A public Exploit-DB reference exists, but the provided sources do not establish current active exploitation. CVE KEV status is false. Treat this as publicly known and easy to rediscover, but do not assume it is being exploited today.
Researcher notes
Key gaps are missing CVSS, CWE, CPE, authentication context, version range, and vendor remediation. Validate by code review or controlled testing in an owned environment only. Avoid assuming impact beyond arbitrary contact deletion.
Mitigation direction
- Identify any Telephone Directory 2008 deployments and owners.
- Restrict public access to the application until vendor guidance is confirmed.
- Back up and monitor contact directory data for unexpected deletions.
- Check vendor or maintainer guidance for patches or supported upgrade paths.
- Retire or isolate the application if no maintained fix exists.
Validation and detection
- Search asset inventory for Telephone Directory 2008 or del_query1.php.
- Review web server logs for unexpected requests to del_query1.php.
- Verify whether contact deletion requires authentication and authorization.
- Confirm whether affected systems are internet-accessible.
- Check recent backups and audit trails for unexplained contact removals.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2008-7180 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 5769CVE reference · exploit, x_refsource_EXPLOIT-DB
- telephonedirectory2008-id-weak-security(42973)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.