CVE-2007-3230: PHP::HTML phphtml.php Remote File Inclusion Enables Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityPublic exploit code exists and EPSS is very high, but the CVSS 2.0 base score is only 6.8 and the affected product is an old, likely niche library.

What it is

PHP::HTML 0.6.4 contains a remote file inclusion flaw in phphtml.php where the htmlclass_path parameter is used to include a remote file without validation. An attacker can point that parameter at a malicious URL and cause arbitrary PHP code to run on the server. The record is old and thin on affected-version detail beyond the stated 0.6.4.

Impact

Successful exploitation gives the attacker arbitrary PHP code execution in the context of the web server, which can lead to full compromise of the application and host. The CVSS 2.0 vector rates partial confidentiality, integrity and availability impact.

Attack surface

The flaw is reachable over the network through HTTP requests to phphtml.php with a crafted htmlclass_path value. No authentication is required per the CVSS vector (Au:N), and no user interaction is indicated.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at 0.67855 (99.284th percentile) and a public Exploit-DB entry (4072) exists, indicating known exploit code is available.

What to do

• Patch or upgrade PHP::HTML past the affected 0.6.4 release if a fixed version is available; if not, remove or disable the vulnerable phphtml.php component.
• Block remote file inclusion by setting allow_url_include=Off and allow_url_fopen=Off in PHP configuration.
• Restrict outbound HTTP from the web server and validate or whitelist any path values passed to include/require statements.
• Deploy WAF rules that reject requests to phphtml.php containing URL schemes (http, https, ftp) in the htmlclass_path parameter.
• Isolate the affected application behind network controls and monitor for unexpected outbound connections from the web tier.

Detection

• Search web server logs for requests to phphtml.php with htmlclass_path containing http://, https://, ftp:// or other URL schemes.
• Monitor for PHP processes making outbound network connections to unfamiliar hosts, which can indicate remote file inclusion.
• Look for unexpected PHP files or webshells written to web-accessible directories following suspicious phphtml.php requests.
• Alert on repeated 200 responses to phphtml.php with external URL parameters from the same source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.