CVE-2007-4757

published 2007-09-08

CVE-2007-4757: PHP remote file inclusion vulnerability in menu.php in phpMytourney allows remote attackers to execute arbitrary PHP code via a URL in the functions_file…

Priority P3 58 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

PHP remote file inclusion vulnerability in menu.php in phpMytourney allows remote attackers to execute arbitrary PHP code via a URL in the functions_file parameter.

Detection & IOCs extracted from sources · hover to see the quote

url http://[target]/[path]/menu.php?functions_file=[SHELL]↗

path menu.php↗

• → Monitor HTTP requests to menu.php containing a URL (http:// or https://) in the 'functions_file' GET parameter, which indicates an RFI attempt. ↗
• → The vulnerable code path is a bare include() of the user-supplied parameter: include($functions_file); — any external URL passed here will result in remote code execution. ↗

• · Exploitation requires PHP's allow_url_include (and allow_url_fopen) to be enabled on the target server, as the vulnerability relies on PHP including a remote URL. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20