Vulnerability record · CVE-2007-4818 · published 11 September 2007
CVE-2007-4818: Txx CMS Remote File Inclusion in doc_root Parameter Enables PHP Code Execution
TTxx Cms · Txx Cms
Txx CMS 0.2 contains multiple PHP remote file inclusion flaws because the doc_root parameter is used without validation in addons/plugin.php, addons/sidebar.php, mail/index.php, and mail/mailbox.php. An attacker can supply a remote URL to that parameter and cause the application to include and execute arbitrary PHP code. The record does not list affected version ranges beyond Txx CMS 0.2.
Description
Multiple PHP remote file inclusion vulnerabilities in Txx CMS 0.2 allow remote attackers to execute arbitrary PHP code via a URL in the doc_root parameter to (1) addons/plugin.php, (2) addons/sidebar.php, (3) mail/index.php, or (4) mail/mailbox.php in modules/.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityThe flaw allows unauthenticated remote code execution, public exploit code is referenced, and EPSS is very high, though the product is an old, likely unsupported CMS.
What it is
Txx CMS 0.2 contains multiple PHP remote file inclusion flaws because the doc_root parameter is used without validation in addons/plugin.php, addons/sidebar.php, mail/index.php, and mail/mailbox.php. An attacker can supply a remote URL to that parameter and cause the application to include and execute arbitrary PHP code. The record does not list affected version ranges beyond Txx CMS 0.2.
Impact
Successful exploitation gives the attacker arbitrary PHP code execution in the context of the web server, which can lead to full compromise of the application and its data. The CVSS 2.0 vector rates confidentiality, integrity, and availability impact as partial.
Attack surface
The flaw is reachable over the network through HTTP requests to the listed PHP scripts, with no authentication required per the CVSS vector (AV:N/AC:L/Au:N). No user interaction is indicated by the record.
Exploitation
CISA KEV does not list this CVE, but EPSS shows a 30-day probability of 0.55541 (99th percentile), and the references include an Exploit-DB entry, indicating public exploit code is available.
What to do
- Patch or upgrade Txx CMS to a version that fixes the doc_root inclusion issue; if no fixed version exists, treat the product as unsupported and plan replacement.
- Disable or remove the vulnerable scripts (addons/plugin.php, addons/sidebar.php, mail/index.php, mail/mailbox.php) if they are not required.
- Configure PHP to disable allow_url_include and allow_url_fopen where operationally possible to block remote file inclusion.
- Apply a web application firewall rule to block requests containing external URLs in the doc_root parameter.
- Restrict outbound network access from the web server to limit retrieval of attacker-hosted payloads.
Detection
- Search web server access logs for requests to the four affected scripts with doc_root containing http:// or https:// values.
- Monitor for unexpected outbound HTTP connections from the web server to external hosts.
- Review PHP error logs and file integrity for newly created or modified PHP files under the web root.
- Alert on requests to addons/plugin.php, addons/sidebar.php, mail/index.php, or mail/mailbox.php from untrusted sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-4818 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-4818), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
