CVE-2007-4809: OFFL PHP remote file inclusion in DOC_ROOT parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the product is old and likely low-deployment.

What it is

Online Fantasy Football League (OFFL) 0.2.6 passes the DOC_ROOT parameter without sanitization in lib/functions.php and lib/header.php, allowing remote file inclusion. An attacker can point DOC_ROOT at a remote PHP file and have the server execute it, giving arbitrary code execution on the web host.

Impact

An attacker gains remote code execution with the privileges of the web server, enabling full compromise of the application and any data or host resources it can reach.

Attack surface

Reachable over the network via HTTP requests to lib/functions.php or lib/header.php with a crafted DOC_ROOT URL; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.56351 (99th percentile) and a SecurityFocus reference is tagged Exploit, with a public Exploit-DB entry (4374), so exploitation is likely and tooling is public.

What to do

• Upgrade or patch OFFL beyond 0.2.6, or remove the affected lib/functions.php and lib/header.php code paths if the product is unsupported.
• Disable allow_url_include and allow_url_fopen in PHP to block remote file inclusion.
• Restrict outbound HTTP from the web server and block access to the vulnerable scripts at the WAF or reverse proxy.
• Run the application with least privilege and isolate it so a compromised process cannot reach sensitive internal systems.

Detection

• Search web logs for requests to lib/functions.php or lib/header.php with DOC_ROOT containing http:// or https:// URLs.
• Alert on PHP processes making outbound HTTP connections or loading code from remote hosts.
• Monitor for unexpected PHP files or webshells written under the web root after such requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.