CVE-2007-4232: PHPNews change_action.php remote file inclusion allows PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated remote code execution, public exploit code exists, and EPSS is very high, though the product is old and not in KEV.

What it is

PHPNews 0.93 contains a remote file inclusion flaw in admin/inc/change_action.php, where the format_menue parameter is used to include a remote file without validation. An attacker can point that parameter at a malicious URL and cause the server to execute arbitrary PHP code. The issue is remotely reachable and does not require authentication.

Impact

Successful exploitation gives the attacker arbitrary PHP code execution in the context of the web server, which can lead to full compromise of the PHPNews host and any data it can reach. The CVSS 2.0 vector rates partial confidentiality, integrity and availability impact.

Attack surface

The flaw is reached over the network through the format_menue parameter in admin/inc/change_action.php. The CVSS vector shows no authentication requirement (Au:N) and medium access complexity (AC:M), and the description does not indicate any user interaction requirement.

Exploitation

Public exploit references are present, including a SecurityFocus BID tagged Exploit and an Exploit-DB entry, so exploitation code is publicly available. The record is not listed in CISA KEV, but EPSS is high at 0.51651 (98.9th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade PHPNews to a version later than 0.93 if one is available; the record does not name a fixed version, so verify with the vendor.
• If upgrade is not possible, remove or disable admin/inc/change_action.php or restrict access to the admin directory.
• Disable allow_url_include and allow_url_fopen in PHP configuration to block remote file inclusion.
• Apply input validation or a WAF rule that rejects URL values in the format_menue parameter.
• Isolate the PHPNews host with network controls and least-privilege web server permissions to limit post-exploitation impact.

Detection

• Monitor web server and PHP logs for requests to admin/inc/change_action.php with format_menue containing http:// or https:// URLs.
• Alert on outbound HTTP requests originating from the PHPNews web server process to unexpected external hosts.
• Search for unexpected PHP files or webshells written under the web root or in writable directories.
• Review PHP error logs for include or fopen warnings involving remote URLs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.