CVE-2007-2676

published 2007-05-14

CVE-2007-2676: PHP remote file inclusion vulnerability in skins/header.php in Open Translation Engine (OTE) 0.7.8 allows remote attackers to execute arbitrary PHP code via a…

Priority P3 57 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

PHP remote file inclusion vulnerability in skins/header.php in Open Translation Engine (OTE) 0.7.8 allows remote attackers to execute arbitrary PHP code via a URL in the ote_home parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
open_translation_engine	open_translation_engine	—	—

Detection & IOCs extracted from sources · hover to see the quote

path skins/header.php↗

command [Path]/skins/header.php?ote_home=Shell↗

• → Detect HTTP requests targeting skins/header.php with a URL-like value in the ote_home query parameter, indicative of remote file inclusion exploitation. ↗
• → The vulnerable parameter is 'ote_home' in skins/header.php; monitor for external URLs or shell paths passed to this parameter. ↗

• · Exploitation requires the PHP 'allow_url_include' (or 'allow_url_fopen') directive to be enabled on the target server for remote file inclusion to succeed. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.