Vulnerability record · CVE-2007-4744 · published 6 September 2007
CVE-2007-4744: AnyInventory environment.php remote file inclusion via DIR_PREFIX
Anyinventory · Anyinventory
AnyInventory 1.9.1 and 2.0 contains a remote file inclusion flaw in environment.php: when register_globals is enabled, the DIR_PREFIX parameter is not validated before being used in a file include. An attacker who can reach the script can point DIR_PREFIX at a remote URL and cause arbitrary PHP code to execute on the server.
Description
PHP remote file inclusion vulnerability in environment.php in AnyInventory 1.9.1 and 2.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the DIR_PREFIX parameter.
AV:N/AC:M/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote, unauthenticated code execution with public exploit code and a very high EPSS score, tempered only by the register_globals precondition and the age of the product.
What it is
AnyInventory 1.9.1 and 2.0 contains a remote file inclusion flaw in environment.php: when register_globals is enabled, the DIR_PREFIX parameter is not validated before being used in a file include. An attacker who can reach the script can point DIR_PREFIX at a remote URL and cause arbitrary PHP code to execute on the server.
Impact
Successful exploitation gives the attacker remote code execution in the context of the web server, allowing full compromise of the application and any data or host resources it can reach.
Attack surface
Reachable over the network via HTTP requests to environment.php; no authentication is required per the CVSS vector (Au:N), though the target PHP configuration must have register_globals enabled. No user interaction is indicated.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.60095, ~99th percentile) and a public Exploit-DB entry (4365) exists, indicating exploit code is publicly available.
What to do
- Upgrade or patch AnyInventory to a version that validates DIR_PREFIX; if no fixed release exists, treat the product as unsupported and migrate off it.
- Disable register_globals in php.ini, which removes the precondition for this flaw.
- Block outbound HTTP from the web server and disable allow_url_include/allow_url_fopen so remote URLs cannot be included.
- Restrict network access to environment.php and the application to trusted clients only.
- Run the web application under a low-privilege account with open_basedir set to limit file access.
Detection
- Search web and PHP logs for requests to environment.php with a DIR_PREFIX parameter containing http://, https://, ftp:// or other URL schemes.
- Alert on PHP include/require errors or unexpected outbound HTTP connections originating from the web server process.
- Monitor for new or modified PHP files in web-accessible directories that could indicate dropped webshells.
- Review PHP configuration baselines for register_globals=On and allow_url_include=On on hosts running AnyInventory.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-4744 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-4744), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
