CVE-2007-3325: LAN Management System PHP remote file inclusion in language.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though no confirmed in-the-wild activity is recorded.

What it is

LAN Management System (LMS) 1.9.6 and earlier contains a remote file inclusion flaw in lib/language.php, where the _LIB_DIR parameter is used to include a remote file without validation. An attacker can point that parameter at a URL hosting malicious PHP, causing arbitrary code execution on the server. The record does not list specific affected versions beyond '1.9.6 and earlier'.

Impact

Successful exploitation lets a remote, unauthenticated attacker execute arbitrary PHP code in the web server's context, leading to full compromise of the LMS application and its host. This can expose administrative data and provide a foothold for lateral movement.

Attack surface

Reachable over the network via HTTP requests to lib/language.php with a crafted _LIB_DIR value; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required. The description does not state whether the endpoint is otherwise restricted.

Exploitation

No CISA KEV listing and no ransomware association are recorded, but EPSS is 0.64362 (99.2nd percentile) and a public Exploit-DB entry (4086) exists, indicating exploit code is publicly available and exploitation is plausible.

What to do

• Apply the vendor patch or upgrade LMS past 1.9.6 if a fixed release exists; the record does not name a patched version, so confirm with the vendor.
• Disable allow_url_include and allow_url_fopen in PHP configuration to block remote file inclusion.
• Restrict or block HTTP access to lib/language.php and other library files that should not be directly reachable.
• Deploy a WAF rule to reject requests where _LIB_DIR contains a URL or remote scheme.
• If the product is no longer maintained, migrate to a supported alternative or isolate the instance from untrusted networks.

Detection

• Search web logs for requests to lib/language.php with _LIB_DIR values containing http://, https://, ftp:// or other remote schemes.
• Monitor for outbound HTTP connections from the web server to unfamiliar hosts, which may indicate remote include fetches.
• Look for unexpected PHP files or webshells written under the web root or in temporary directories.
• Alert on PHP include or file-open errors referencing remote URLs in application logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.