CVE-2007-3524: Ripe Website Manager PHP file inclusion in admin header scripts

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the product is old and the CVSS base score is only 6.8.

What it is

Ripe Website Manager 0.8.9 and earlier contains multiple PHP remote file inclusion flaws in admin/includes/author_panel_header.php and admin/includes/admin_header.php. The level parameter is passed into a PHP include without validation, letting a remote attacker supply a URL to attacker-controlled code. Because the included file executes as PHP, this leads to arbitrary code execution on the server.

Impact

An attacker can execute arbitrary PHP code on the web server, which typically yields full control of the application and its data, and can be used to pivot further into the host.

Attack surface

Reachable over the network through HTTP requests to the two admin include scripts, with the malicious URL supplied in the level parameter. The CVSS vector (AV:N/AC:M/Au:N) indicates no authentication is required, though the medium access complexity suggests some condition or setup may be needed.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded. EPSS is high (0.642, 99.19th percentile) and a public Exploit-DB entry (4129) exists, indicating exploit code is publicly available.

What to do

• Upgrade or remove Ripe Website Manager 0.8.9 and earlier; the vendor advisory should be checked for a fixed release, and if none exists, retire the product.
• Disable PHP allow_url_include and allow_url_fopen where possible to blunt remote file inclusion.
• Restrict or block direct web access to admin/includes/ files and require authentication for all admin paths.
• Validate and whitelist the level parameter, rejecting any value containing a URL or path separator.
• Run the application with least privilege and keep PHP and the web server patched.

Detection

• Search web logs for requests to admin/includes/author_panel_header.php or admin/includes/admin_header.php with a level parameter containing http://, https://, ftp:// or similar schemes.
• Monitor for outbound HTTP requests from the web server to unfamiliar hosts, which can indicate a successful remote include.
• Look for unexpected PHP files or webshells written under the web root and for PHP processes spawning shell commands.
• Alert on repeated 200 responses to those admin include paths from external or unauthenticated sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.