CVE-2007-5842

published 2007-11-06

CVE-2007-5842: Multiple PHP remote file inclusion vulnerabilities in Vortex Portal 1.0.42 allow remote attackers to execute arbitrary PHP code via a URL in the cfgProgDir…

Priority P3 49 medium 6.8 CVSS 2.0

AV N AC M Au N C P I P A P

EXPLOIT

Multiple PHP remote file inclusion vulnerabilities in Vortex Portal 1.0.42 allow remote attackers to execute arbitrary PHP code via a URL in the cfgProgDir parameter to (1) admincp/auth/secure.php or (2) admincp/auth/checklogin.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
vortex_portal	vortex_portal	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://www.igamingcms.com/legacy-software/VortexPortal1.0.42.zip↗

path /admincp/auth/secure.php↗

path /admincp/auth/checklogin.php↗

• → Monitor HTTP requests targeting admincp/auth/secure.php or admincp/auth/checklogin.php with a URL-like value in the cfgProgDir parameter, indicating a Remote File Inclusion attempt. ↗
• → Exploitation requires PHP register_globals to be ON; presence of this setting combined with requests to the vulnerable paths is a strong indicator of exploitation conditions. ↗

• · The RFI vulnerability is only exploitable when PHP's register_globals directive is enabled (ON). Installations with register_globals OFF are not vulnerable. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94