CVE-2007-3522: sPHPell PHP remote file inclusion in SpellIncPath parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityPublic exploit code and a very high EPSS score make exploitation likely, though the CVSS 2.0 base score is only 6.8 and no KEV listing exists.

What it is

sPHPell 1.01 contains multiple PHP remote file inclusion flaws in spellcheckpageinc.php, spellchecktext.php, spellcheckwindow.php and spellcheckwindowframeset.php. An attacker can supply a URL through the SpellIncPath parameter to pull in and execute arbitrary PHP code. The record does not list affected versions beyond 1.01 or any vendor fix.

Impact

Successful exploitation lets a remote attacker run arbitrary PHP code in the context of the web server, leading to full compromise of the application and potentially the host. No privilege escalation beyond the web server account is described in the record.

Attack surface

The flaw is reachable over the network through HTTP requests to the four listed PHP scripts, with the malicious URL passed in the SpellIncPath parameter. The CVSS vector (AV:N/AC:M/Au:N) indicates no authentication is required, though some conditions must be met for the include to succeed.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.66157 (99.2nd percentile) and a public Exploit-DB entry (4132) exists, indicating exploit code is publicly available. No ransomware usage is documented in the record.

What to do

• Apply the vendor patch or upgrade sPHPell if a fixed release exists; the record does not name one, so verify with the vendor.
• If no fix is available, remove or disable the four vulnerable scripts (spellcheckpageinc.php, spellchecktext.php, spellcheckwindow.php, spellcheckwindowframeset.php).
• Block remote file inclusion by disabling allow_url_include and allow_url_fopen in php.ini where feasible.
• Restrict outbound HTTP from the web server and validate or whitelist the SpellIncPath parameter.
• Place the application behind a WAF rule that blocks URL values in SpellIncPath and similar include parameters.

Detection

• Search web logs for requests to the four vulnerable scripts with a URL or remote path in the SpellIncPath parameter.
• Alert on outbound HTTP connections originating from the web server process to unexpected hosts.
• Monitor for new or modified PHP files in the web root that could indicate dropped webshells.
• Review PHP error logs for include or fopen failures referencing remote URLs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.