CVE-2007-2093: Limesoft Guestbook PHP code injection via message parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated remote code injection with a high EPSS score and public exploit code, though the product is old and no fixed version is documented.

What it is

Limesoft Guestbook (LS Simple Guestbook) 1.0 writes the message parameter directly into posts.txt without sanitization, allowing remote attackers to inject arbitrary PHP code. Because the injected content is stored in a file, the flaw is a static code injection issue that can lead to server-side code execution. The record is old and thin, but the vector and description are clear.

Impact

An attacker can place arbitrary PHP code into posts.txt, which may execute on the server when the file is accessed, giving code execution in the web server context. This can lead to data theft, defacement, or further compromise of the host.

Attack surface

The flaw is reached over the network through index.php using the message parameter, with no authentication required per the CVSS vector AV:N/AC:L/Au:N. No user interaction is indicated in the record.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at 0.45693 (98.7th percentile) and a public Exploit-DB entry exists, indicating known exploit code is available. The record does not state whether exploitation has been observed in the wild.

What to do

• Upgrade or replace Limesoft Guestbook 1.0; no fixed version is stated in the record, so treat the product as unsupported and migrate to a maintained guestbook.
• If the application must remain, block or strictly validate the message parameter and reject PHP tags and code-like input.
• Store posts.txt outside the web root and serve guestbook content through a handler that does not execute PHP.
• Disable PHP execution in any directory that can receive user-supplied files.
• Apply a WAF rule to block PHP code patterns in POST data to index.php.

Detection

• Monitor posts.txt and related guestbook data files for PHP tags such as <?php or <?=.
• Alert on POST requests to index.php with message parameters containing PHP code or unusual script content.
• Review web server logs for requests to posts.txt or other guestbook files that return PHP execution or unexpected content.
• Check for unexpected changes to guestbook files and for outbound connections from the web server after guestbook submissions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.