CVE-2008-2044

CVE-2008-2044 is an authentication bypass and arbitrary code execution vulnerability affecting netOffice Dwins 1.3 p2. It stems from an incorrect comparison of the 'demoSession' variable, allowing remote attackers to bypass authentication by setting this variable to '1'. This flaw enables attackers to upload arbitrary PHP scripts, as demonstrated by an exploit targeting projects_site/uploadfile.php. The vulnerability has a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low attack complexity, and potential for partial confidentiality, integrity, and availability impact. Its FAUCET Risk Score is 94/100, further highlighting its critical nature. While not listed in the KEV catalog, exploit code for this vulnerability is publicly available on ExploitDB. There is no evidence of active exploitation, and it has received minimal community discussion or media coverage.