CVE-2007-2708: News-Script newsadmin.php remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the affected product is an old niche script.

What it is

Feindt Computerservice News (News-Script) 2.0 contains a remote file inclusion flaw in newsadmin.php. The action parameter is used to build a file path without validation, so a remote attacker can supply a URL and cause the application to include and execute arbitrary PHP code. This is a full remote code execution path against an unauthenticated endpoint.

Impact

An attacker can execute arbitrary PHP code on the server, leading to web shell deployment, data theft, or full host compromise under the web server account.

Attack surface

Reachable over the network through newsadmin.php with the action parameter; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.61727 (99.1st percentile) and references are tagged Exploit, indicating public exploit code exists and exploitation is likely.

What to do

• Patch or replace News-Script 2.0; the vendor has not issued a fix in this record, so treat the product as end-of-life and migrate to a maintained alternative.
• If the application must stay online, block remote URL inclusion by disabling allow_url_include and allow_url_fopen in PHP.
• Restrict access to newsadmin.php to trusted administrative networks or remove it from public exposure.
• Deploy a WAF rule that rejects requests to newsadmin.php where the action parameter contains a URL scheme such as http://, https://, ftp://, or php://.
• Run the web service under a least-privilege account with open_basedir and disable_functions set to limit post-exploitation impact.

Detection

• Search web logs for requests to newsadmin.php with action values containing http://, https://, ftp://, or php://.
• Monitor for unexpected PHP files created in web-accessible directories and for outbound HTTP requests originating from the web server process.
• Alert on PHP include or require errors referencing remote hosts in application error logs.
• Use file integrity monitoring on the web root to catch newly written scripts or modified PHP files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.