CVE-2007-3401

published 2007-06-26

CVE-2007-3401: PHP remote file inclusion vulnerability in footer.inc.php in B1G b1gBB 2.24 allows remote attackers to execute arbitrary PHP code via a URL in the tfooter…

Priority P3 58 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

PHP remote file inclusion vulnerability in footer.inc.php in B1G b1gBB 2.24 allows remote attackers to execute arbitrary PHP code via a URL in the tfooter parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
b1g	b1gbb	—	—

Detection & IOCs extracted from sources · hover to see the quote

path footer.inc.php↗

command http://www.name/path/footer.inc.php?tfooter=shell?↗

• → Monitor HTTP requests targeting footer.inc.php with a 'tfooter' parameter containing an external URL (http:// or https://), which indicates an attempted remote file inclusion exploit. ↗
• → The vulnerable code path is a bare `include $tfooter` in footer.inc.php with no sanitization; look for unsanitized user-supplied include paths in PHP application logs. ↗
• → Exploit requests follow the pattern: GET /path/footer.inc.php?tfooter=<remote_url> — flag any request where the tfooter query parameter value begins with a remote scheme (http/https/ftp). ↗

• · The exploit URL template uses a placeholder hostname and path ('www.name/path/'); real attacks will substitute an attacker-controlled domain and shell payload URL in the tfooter parameter. ↗
• · Vulnerability is confirmed only in b1gBB version 2.24 / 2.24.0; other versions are not referenced in the available sources. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.