CVE-2007-1697

published 2007-03-27

CVE-2007-1697: PHP remote file inclusion vulnerability in header.inc.php in Philex 0.2.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the…

Priority P2 61 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

PHP remote file inclusion vulnerability in header.inc.php in Philex 0.2.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CssFile parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
philex	philex	<= 0.2.3	—

Detection & IOCs extracted from sources · hover to see the quote

path /header.inc.php↗

path /download.php↗

path conf.inc.php↗

• → Monitor HTTP requests to header.inc.php containing a URL or remote shell path in the 'CssFile' GET parameter, indicating remote file inclusion exploitation. ↗

• · The RFI vulnerability affects Philex 0.2.3 and earlier; the vulnerable parameter is 'CssFile' in header.inc.php. Detection rules should scope to this specific application path and parameter name. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.