Vulnerability record · CVE-2007-3401 · published 26 June 2007
CVE-2007-3401: b1gBB footer.inc.php remote file inclusion enables PHP code execution
B1g · B1gbb
footer.inc.php in B1G b1gBB 2.24 passes the tfooter parameter into a PHP include without validation, allowing a remote attacker to supply a URL to an external file. Because the included file is executed as PHP, this yields remote code execution on the web server. The flaw is a classic remote file inclusion in an old forum package.
Description
PHP remote file inclusion vulnerability in footer.inc.php in B1G b1gBB 2.24 allows remote attackers to execute arbitrary PHP code via a URL in the tfooter parameter.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the product is old and likely low prevalence.
What it is
footer.inc.php in B1G b1gBB 2.24 passes the tfooter parameter into a PHP include without validation, allowing a remote attacker to supply a URL to an external file. Because the included file is executed as PHP, this yields remote code execution on the web server. The flaw is a classic remote file inclusion in an old forum package.
Impact
An unauthenticated attacker can run arbitrary PHP code with the web server's privileges, leading to full compromise of the application and potentially the host. This can expose data, allow web shell placement, and pivot into the underlying system.
Attack surface
Reachable over the network via HTTP requests to footer.inc.php with a crafted tfooter parameter; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.73961, 99.456th percentile) and a public Exploit-DB entry (4102) exists, indicating mature, widely available exploit code.
What to do
- Upgrade or replace b1gBB 2.24 with a maintained version; if no fix exists, retire the product.
- Disable allow_url_include and allow_url_fopen in php.ini to block remote file inclusion.
- Restrict outbound network access from the web server to prevent fetching attacker-hosted payloads.
- Deploy a WAF rule blocking URL values in the tfooter parameter and similar include parameters.
- Remove or isolate footer.inc.php if the forum is no longer needed.
Detection
- Search web logs for requests to footer.inc.php with tfooter containing http://, https://, ftp:// or other URL schemes.
- Monitor for unexpected outbound HTTP requests originating from the web server process.
- Alert on new or modified PHP files in web-accessible directories, which may indicate dropped web shells.
- Review PHP error logs for include or fopen failures referencing remote hosts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-3401 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-3401), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
