CVE-2007-3522

published 2007-07-03

CVE-2007-3522: Multiple PHP remote file inclusion vulnerabilities in sPHPell 1.01 allow remote attackers to execute arbitrary PHP code via a URL in the SpellIncPath parameter…

Priority P3 51 medium 6.8 CVSS 2.0

AV N AC M Au N C P I P A P

EXPLOIT

Multiple PHP remote file inclusion vulnerabilities in sPHPell 1.01 allow remote attackers to execute arbitrary PHP code via a URL in the SpellIncPath parameter to (1) spellcheckpageinc.php, (2) spellchecktext.php, (3) spellcheckwindow.php, or (4) spellcheckwindowframeset.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
sphpell	sphpell	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /checkpageinc.php?SpellIncPath=↗

path /spellchecktext.php?SpellIncPath=↗

path /spellcheckwindow.php?SpellIncPath=↗

path /spellcheckwindowframeset.php?SpellIncPath=↗

filename spellcheckpageinc.php↗

filename spellchecktext.php↗

filename spellcheckwindow.php↗

filename spellcheckwindowframeset.php↗

• → Detect RFI exploitation attempts by monitoring HTTP requests containing the 'SpellIncPath' parameter with an external URL value (e.g., http://) targeting any of the four vulnerable sPHPell scripts. ↗
• → The vulnerable sink is a bare `include($SpellIncPath."spellcheckvars.php")` call — any user-controlled URL prefix in SpellIncPath will cause remote code execution. Alert on GET/POST requests where SpellIncPath value begins with 'http://' or 'https://'. ↗

• · The vulnerability only exists when PHP's 'allow_url_include' (and 'allow_url_fopen') directives are enabled, which is required for remote file inclusion to succeed. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.