CVE-2008-5694 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5694): PHP remote file inclusion vulnerability in lib/jpgraph/jpgraph_errhandler.inc.php in Sandbox 1.4.1 might allow remote attackers to execute arbitrary PHP code via unspecified vectors. NOTE: the issue, if any, may be located in Aditus JpGraph rather than Sandbox. If so, then this should not be treated as an issue in Sandbox.
Unfortunately, the advisory is only available at http://www.by-f10.com/bug.txt and I could not find a copy and the server is unavailable. Let's track this issue as unconfirmed for now. I did not thoroughly review the code, but there is no obvious RFI there.
Cannot find the contents of the advisory URL anywhere either and had a quick look at the code myself... jpgraph itself is not vulnerable, i.e. just by having jpgraph installed nobody will be able to exploit the issue. We are talking about a local file inclusion vulnerability here, btw, not remote. And maybe XSS, because the filename becomes part of an error message in case of an error. Any application which calls JpGraphError::SetErrLocale() with untrusted user input may be vulnerable to this issue, but to actually execute PHP code an attacker has to place the code as a file on the system somehow (image upload functionality or similar). Depending on how the used libc handles \0 bytes, the attack may be limited to files ending with .inc.php anyway, so... Still, a fix should probably be applied to jpgraph.
Even the CVE doesn't have much information beyond this affecting an old version of sandbox (long gone from tree). Closing NEEDINFO.
