CVE-2007-3236: XOOPS Horoscope module footer.php remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit code and a very high EPSS score, though the affected module is old and not in KEV.

What it is

The Horoscope 1.0 module for XOOPS passes the xoopsConfig[root_path] parameter from footer.php into a PHP include without validation, allowing remote file inclusion. An attacker can point that parameter at a remote file and cause the server to execute arbitrary PHP code. The flaw is remotely reachable and needs no credentials.

Impact

An attacker gains remote code execution in the context of the web server, which can lead to full compromise of the XOOPS site and its host. This includes data theft, defacement, and use of the server as a foothold.

Attack surface

Reached over the network via HTTP requests to footer.php in the Horoscope module, with the xoopsConfig[root_path] parameter controlled by the attacker. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Public exploit references exist (Attrition VIM, SecurityFocus BID 24449, Exploit-DB 4064), and EPSS is 0.76982 (99.5th percentile), indicating high likelihood of exploitation activity. The CVE is not listed in CISA KEV.

What to do

• Apply the vendor fix or update the Horoscope module and XOOPS core to a version that validates the root_path parameter; if no patch exists, remove or disable the Horoscope module.
• Block remote file inclusion by setting allow_url_include=Off and allow_url_fopen=Off in php.ini where feasible.
• Restrict outbound HTTP from the web server so it cannot fetch attacker-controlled PHP files.
• Deploy a WAF rule to reject requests to footer.php containing external URLs in xoopsConfig[root_path].
• Audit the web root for unexpected PHP files and remove any dropped shells.

Detection

• Search web logs for requests to Horoscope footer.php with xoopsConfig[root_path] containing http://, https://, ftp://, or other URL schemes.
• Monitor for outbound HTTP connections from the web server to unfamiliar hosts, especially around requests to module footer.php files.
• Alert on new or modified PHP files in the XOOPS web root and on PHP processes spawning shell commands.
• Review PHP error logs for include or fopen failures referencing remote URLs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.