CVE-2007-3370: Sun Board PHP remote file inclusion in include.php and doctype.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the product is an old alpha release with limited deployment.

What it is

Sun Board 1.00.00 Alpha contains multiple PHP remote file inclusion flaws. Attackers can supply a URL through the sunPath parameter to include.php or the dir parameter to skin/board/default/doctype.php, causing the application to load and execute remote PHP code. This allows arbitrary code execution on the server without authentication.

Impact

An unauthenticated attacker can execute arbitrary PHP code on the web server, leading to full compromise of the application and potentially the underlying host.

Attack surface

Reachable over the network via HTTP requests to include.php and skin/board/default/doctype.php. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.745 probability, 99.47th percentile) and a public Exploit-DB entry (4091) exists, indicating known exploit code is available.

What to do

• Apply the vendor patch or upgrade Sun Board to a fixed release if one exists; the record does not specify affected or fixed versions.
• Disable or remove the vulnerable include.php and skin/board/default/doctype.php scripts if they are not required.
• Set PHP allow_url_include=Off and allow_url_fopen=Off to block remote file inclusion.
• Restrict outbound network access from the web server to prevent loading of attacker-controlled remote files.
• Deploy a WAF rule to block URL values in the sunPath and dir parameters.

Detection

• Monitor web logs for requests to include.php or skin/board/default/doctype.php with sunPath or dir parameters containing http:// or https:// URLs.
• Alert on PHP errors or unexpected outbound HTTP connections originating from the web server process.
• Search for newly created or modified PHP files in the web root that may indicate dropped webshells.
• Review server egress traffic for connections to untrusted hosts following requests to these scripts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.