CVE-2008-7193: PHPKIT 1.6.4 PL1 includes the session ID in the URL, which allows remote attackers to conduct cross-site re...

Security readout for executives and security teams

PHPKIT 1.6.4 PL1 put a session identifier in the URL. If that value leaked through the HTTP Referer header, an attacker could abuse it to make unwanted account changes, including creating a new administrator. The bundle does not provide a score, patch, or active exploitation evidence. Exposure is likely limited to internet-facing or internally reachable PHPKIT 1.6.4 PL1 deployments where affected endpoints are present and session IDs can appear in URLs or Referer logs. Treat this as a high-priority legacy web application risk if PHPKIT is still deployed. The administrator-creation impact is serious, but urgency depends on whether the obsolete product is present and reachable. Mitigation focus: Check PHPKIT vendor or maintainer guidance for a fixed version or migration path.; Retire or isolate PHPKIT 1.6.4 PL1 if no supported fix exists.; Disable URL-based session identifiers where the platform supports it..

Prepared

Jun 28, 2026, 10:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.