CVE-2007-4279: FrontAccounting config.php remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the product is an older accounting application and no KEV listing exists.

What it is

FrontAccounting 1.12 Build 31 passes the path_to_root parameter in config.php without validation, allowing a remote attacker to include an arbitrary URL and execute PHP code. The flaw is remotely reachable without authentication and gives full code execution on the web server.

Impact

An attacker can run arbitrary PHP code in the context of the web server, leading to full compromise of the FrontAccounting host and any data it holds.

Attack surface

Reached over the network through HTTP requests to config.php with a crafted path_to_root value; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.753 (99.5th percentile) and a public Exploit-DB entry (4269) exists, indicating known exploit code is available.

What to do

• Upgrade FrontAccounting to a version after 1.12 Build 31 that fixes the path_to_root handling; if no fixed release is available, remove or restrict the affected config.php include logic.
• Disable allow_url_include and allow_url_fopen in php.ini to block remote file inclusion.
• Restrict outbound HTTP from the web server and block access to config.php from untrusted networks via WAF or reverse proxy rules.
• Run the FrontAccounting web service under a low-privilege account with open_basedir set to limit file access.

Detection

• Search web logs for requests to config.php with path_to_root containing http:// or https:// URLs.
• Monitor for unexpected outbound HTTP connections from the web server process.
• Alert on PHP errors or new files in the web root that indicate included or dropped code.
• Review process execution spawned by the web server user for signs of post-exploitation commands.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.