CVE-2007-3057: XOOPS icontent module spaw_control.php remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the CVSS 2.0 base score is only 6.8 and the record may be a duplicate.

What it is

The icontent 4.5 module for XOOPS passes the spaw_root parameter to a PHP include in include/wysiwyg/spaw_control.class.php without validation, allowing remote file inclusion. An attacker who can reach that script can load a remote PHP file and execute code in the web server context. NVD notes the issue is probably a duplicate of CVE-2006-4656.

Impact

An attacker gains arbitrary PHP code execution on the XOOPS host, which can lead to full compromise of the web application and its data. The CVSS 2.0 vector rates partial confidentiality, integrity and availability impact.

Attack surface

Reachable over the network via HTTP requests to the icontent module's spaw_control.class.php with a crafted spaw_root value. The CVSS vector (AV:N/AC:M/Au:N) indicates no authentication is required, though the attack complexity is medium.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded. EPSS is high (0.68669, 99.3rd percentile) and an Exploit-DB entry (4022) exists, indicating public exploit code is available.

What to do

• Apply the vendor fix for the icontent module or upgrade to a version that validates spaw_root; if no fix exists, remove or disable the icontent module.
• Block remote file inclusion by setting allow_url_include=Off and allow_url_fopen=Off in php.ini.
• Restrict outbound HTTP from the web server so it cannot fetch attacker-controlled PHP files.
• Deploy a WAF rule that rejects requests to spaw_control.class.php containing external URLs in spaw_root.

Detection

• Search web logs for requests to include/wysiwyg/spaw_control.class.php with spaw_root containing http:// or https:// or a remote host.
• Monitor for outbound HTTP connections from the web server to unfamiliar hosts, especially followed by PHP execution.
• Alert on unexpected PHP file creation or modification under the XOOPS web root.
• Review PHP error logs for include failures referencing remote URLs in the spaw_root parameter.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.