CVE-2007-3813: MKPortal NoBoard module PHP remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution with a public exploit and very high EPSS, though the CVSS 2.0 base score is only 4.3 and the affected module is old and niche.

What it is

The NoBoard BETA module for MKPortal passes the MK_PATH parameter to include/user.php without sanitization, allowing a remote attacker to include an arbitrary remote file. Because the included file is PHP, this leads to arbitrary PHP code execution on the server. The record is old and thin, but the flaw class and vector are clearly stated.

Impact

An unauthenticated remote attacker can execute arbitrary PHP code in the web server context, which typically means full compromise of the MKPortal site and any data or credentials it can reach.

Attack surface

Reached over the network via an HTTP request to include/user.php with a crafted MK_PATH value pointing at an attacker-controlled URL. No authentication is required; the CVSS vector shows no user interaction beyond sending the request.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but a public Exploit-DB entry (4180) exists and EPSS is high at roughly 0.59 (99th percentile), indicating meaningful real-world exploitation likelihood.

What to do

• Apply the vendor fix or upgrade MKPortal/NoBoard to a version that validates MK_PATH; if no patch exists, remove or disable the NoBoard BETA module.
• Block remote file inclusion by disabling allow_url_include and allow_url_fopen in PHP where feasible.
• Restrict outbound HTTP from the web server and use a WAF rule to reject MK_PATH values containing URL schemes or path traversal.
• Remove or restrict public access to include/user.php if the module is not in active use.

Detection

• Search web logs for requests to include/user.php with MK_PATH containing http://, https://, ftp:// or ../ sequences.
• Alert on outbound HTTP connections from the web server to unfamiliar hosts following such requests.
• Monitor for unexpected PHP file creation or modification in the MKPortal web root and for new processes spawned by the web server user.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.