CVE-2007-2141: ShoutPro shoutbox.php PHP code injection via shout parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit code and a very high EPSS score, though the product is old and likely limited in deployment.

What it is

ShoutPro 1.5.2 writes the shout parameter from shoutbox.php directly into shouts.php without sanitization, allowing remote attackers to inject arbitrary PHP code. Because the injected code lands in a PHP file, it can be executed by the web server, turning a simple input flaw into remote code execution on the host.

Impact

An unauthenticated attacker can execute arbitrary PHP code with the privileges of the web server, leading to full compromise of the application and potentially the underlying host. This can expose data, allow file manipulation, and provide a foothold for lateral movement.

Attack surface

The flaw is reachable over the network through shoutbox.php, which accepts the shout parameter; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any internet- or network-exposed ShoutPro 1.5.2 instance is directly reachable.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.45843 (98.7th percentile) and a reference carries the Exploit tag, indicating public exploit code and elevated likelihood of exploitation. No ransomware group usage is documented.

What to do

• Upgrade or replace ShoutPro 1.5.2 with a maintained version or alternative that sanitizes the shout parameter; if no fix exists, remove or disable shoutbox.php.
• Apply input validation and output encoding so user-supplied shout content is never written into executable PHP files.
• Restrict write permissions on shouts.php and the web root so the web server cannot modify PHP files.
• Deploy a WAF rule to block PHP code patterns in the shout parameter as a temporary compensating control.
• Isolate the ShoutPro application from sensitive systems and run it with least-privilege web server credentials.

Detection

• Monitor web server logs for POST or GET requests to shoutbox.php with PHP tags or code-like content in the shout parameter.
• Alert on unexpected modifications to shouts.php or other PHP files in the web root, including new or changed file hashes.
• Hunt for outbound connections or child processes spawned by the web server that are inconsistent with normal ShoutPro behavior.
• Review file integrity monitoring and audit logs for writes to PHP files by the web server user.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.