CVE-2007-0785: Flipsource Flip previewtheme.php remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote unauthenticated code execution with public exploit code and very high EPSS, though the product is old and not in KEV.

What it is

previewtheme.php in Flipsource Flip 2.01-final 1.0 and earlier passes the inc_path parameter to a PHP include without validation, allowing remote file inclusion. An attacker can point inc_path at a remote file containing PHP code, which the server then executes. The flaw is remotely reachable and needs no authentication.

Impact

An attacker gains arbitrary PHP code execution in the web server's context, which can lead to full compromise of the application and its host. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.

Attack surface

Reached over the network via HTTP requests to previewtheme.php with a crafted inc_path parameter; the AV:N/AC:L/Au:N vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.68793 (99.3rd percentile) and a SecurityFocus reference is tagged Exploit, with an Exploit-DB entry present, indicating public exploit code exists.

What to do

• Upgrade or patch Flipsource Flip beyond 2.01-final 1.0, or remove the product if no fixed release exists.
• Disable allow_url_include and allow_url_fopen in PHP configuration to block remote file inclusion.
• Validate and whitelist the inc_path parameter, rejecting URLs and path traversal sequences.
• Restrict outbound network access from the web server to limit retrieval of attacker-hosted payloads.
• If the software is unsupported, retire it or isolate it behind access controls.

Detection

• Search web logs for requests to previewtheme.php with inc_path values containing http://, https://, ftp:// or ../ sequences.
• Monitor for unexpected outbound HTTP requests originating from the web server process.
• Inspect for newly written or modified PHP files in web-accessible directories.
• Alert on PHP include or file-access errors referencing remote URLs in application logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.