CVE-2007-3237: XOOPS TinyContent module PHP remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution with public exploit code and very high EPSS probability, though the CVSS 2.0 base score is only 6.8 and the record may be a duplicate.

What it is

The TinyContent 1.5 module for XOOPS contains a remote file inclusion flaw in admin/spaw/spaw_control.class.php, where the spaw_root parameter is used to include a file without proper validation. An attacker can supply a URL to a remote file, causing the server to fetch and execute arbitrary PHP code. The record notes this issue is probably a duplicate of CVE-2006-4656.

Impact

Successful exploitation lets an attacker run arbitrary PHP code on the web server, which typically leads to full compromise of the XOOPS site and its underlying host. The CVSS 2.0 vector rates partial confidentiality, integrity and availability impact.

Attack surface

The flaw is reachable over the network through the admin/spaw/spaw_control.class.php script in the TinyContent module. The CVSS vector (AV:N/AC:M/Au:N) indicates no authentication is required, though the description does not state whether user interaction is needed.

Exploitation

No CISA KEV listing and no reference tags indicating known exploitation; however, EPSS is 0.67656 (99.28th percentile), and an Exploit-DB entry (4063) exists, so public exploit code is available.

What to do

• Apply the vendor fix referenced in the XOOPS advisory (storyid=3799) or upgrade the TinyContent module to a corrected version.
• If no patch is available, remove or disable the TinyContent module, particularly the admin/spaw directory.
• Set allow_url_include=Off and allow_url_fopen=Off in php.ini to block remote file inclusion.
• Restrict network access to administrative module paths and enforce authentication on admin scripts.
• Monitor and block outbound HTTP requests from the web server to untrusted hosts.

Detection

• Search web server logs for requests to admin/spaw/spaw_control.class.php with a spaw_root parameter containing a URL.
• Look for outbound HTTP connections from the web server to external hosts following such requests.
• Monitor for unexpected PHP files or webshells written under the XOOPS web root.
• Alert on PHP include or require errors referencing remote URLs in application logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.