Vulnerability record · CVE-2007-4313 · published 13 August 2007
CVE-2007-4313: Php Blue Dragon CMS activecontent.php Remote File Inclusion
PPhp Blue Dragon · Php Blue Dragon Cms
Php Blue Dragon CMS 3.0.0 contains a remote file inclusion flaw in public_includes/pub_blocks/activecontent.php. The vsDragonRootPath parameter is used to include a remote file, letting an attacker supply a URL that causes arbitrary PHP code to run. This is a distinct vector from earlier Php Blue Dragon RFI issues.
Description
PHP remote file inclusion vulnerability in public_includes/pub_blocks/activecontent.php in Php Blue Dragon CMS 3.0.0 allows remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter, a different vector than CVE-2006-2392, CVE-2006-3076, and CVE-2006-6958.
AV:N/AC:M/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated code execution with a public exploit and very high EPSS score, though the product is old and likely limited in deployment.
What it is
Php Blue Dragon CMS 3.0.0 contains a remote file inclusion flaw in public_includes/pub_blocks/activecontent.php. The vsDragonRootPath parameter is used to include a remote file, letting an attacker supply a URL that causes arbitrary PHP code to run. This is a distinct vector from earlier Php Blue Dragon RFI issues.
Impact
An unauthenticated attacker can execute arbitrary PHP code on the server, leading to full compromise of the web application and potentially the host. This can expose data, allow persistence, and enable lateral movement.
Attack surface
Reachable over the network via HTTP requests to public_includes/pub_blocks/activecontent.php with a crafted vsDragonRootPath value. No authentication or user interaction is required per the CVSS vector (AV:N/AC:M/Au:N).
Exploitation
Not listed in CISA KEV, but EPSS is 0.68711 (99.3rd percentile) and a public Exploit-DB entry (4276) exists, indicating high likelihood of exploitation attempts.
What to do
- Patch or upgrade Php Blue Dragon CMS beyond 3.0.0; if no vendor fix exists, remove or disable the vulnerable activecontent.php component.
- Block remote file inclusion by setting allow_url_include=Off and allow_url_fopen=Off in PHP configuration.
- Deploy a WAF rule to reject requests to activecontent.php containing external URLs in vsDragonRootPath.
- Restrict outbound network access from the web server to prevent retrieval of attacker-hosted payloads.
- Audit the server for webshells and unexpected PHP files if compromise is suspected.
Detection
- Monitor web logs for requests to public_includes/pub_blocks/activecontent.php with vsDragonRootPath containing http:// or https:// URLs.
- Alert on outbound HTTP connections from the web server to unfamiliar hosts following such requests.
- Search file system for newly created or modified PHP files in web-accessible directories.
- Review PHP error logs for include failures referencing remote URLs.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-4313 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-4313), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
