CVE-2007-3221: XOOPS XT-Conteudo module PHP remote file inclusion in spaw_control.class.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with no authentication required and a high EPSS score plus public exploit code make this a serious risk despite the medium CVSS 2.0 rating.

What it is

The XT-Conteudo module for XOOPS contains a PHP remote file inclusion flaw in admin/spaw/spaw_control.class.php, where the spaw_root parameter is used to include a remote file without validation. An attacker can point that parameter at a hostile URL and cause arbitrary PHP code to run on the server. The record itself notes this issue is probably a duplicate of CVE-2006-4656, so the same underlying flaw may already be tracked elsewhere.

Impact

Successful exploitation gives the attacker remote code execution in the context of the web server, allowing full compromise of the XOOPS site and any data or credentials it can reach. Because the included code runs as the web user, the attacker can persist, pivot, or deface the application.

Attack surface

The flaw is reachable over the network through the module's admin/spaw/spaw_control.class.php script by supplying a URL in the spaw_root parameter. The CVSS vector (AV:N/AC:M/Au:N) indicates no authentication is required, though the medium access complexity suggests some condition or setup may be needed; no user interaction is described.

Exploitation

The record is not listed in CISA KEV and has no ransomware associations, but EPSS is high at 0.678 (99.3rd percentile) and a public Exploit-DB entry (4069) exists, indicating exploit code is available and exploitation is plausible.

What to do

• Apply the vendor fix or upgrade the XT-Conteudo module and XOOPS core to a version that removes or patches the vulnerable spaw_control.class.php include.
• If no patch is available, disable or remove the XT-Conteudo module, or at minimum block access to admin/spaw/spaw_control.class.php.
• Set allow_url_include=Off and allow_url_fopen=Off in PHP configuration to prevent remote file inclusion.
• Restrict web server access to administrative module paths by IP allowlist or authentication at the reverse proxy.
• Review the server for webshells and unexpected PHP files in the web root after any suspected exposure.

Detection

• Search web and proxy logs for requests to admin/spaw/spaw_control.class.php with a spaw_root parameter containing an external URL (http://, https://, ftp://).
• Monitor for outbound HTTP requests originating from the web server process to unfamiliar hosts, which can indicate remote include fetches.
• Alert on new or modified PHP files in the XOOPS web directory, especially in upload or module paths.
• Correlate PHP error log entries referencing include failures or remote URLs in spaw_control.class.php with concurrent HTTP requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.