CVE-2007-5009: phpBB Plus German language file remote file inclusion allows PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote unauthenticated code execution with public exploit references and a very high EPSS percentile, though the affected product is an old, likely low-prevalence phpBB Plus release.

What it is

phpBB Plus 1.53 and 1.53a before 20070922 include language/lang_german/lang_main_album.php without validating the phpbb_root_path parameter, letting a remote attacker supply a URL to an external file. Because the included file is executed as PHP, this is a code injection flaw rather than a simple information disclosure.

Impact

An attacker can execute arbitrary PHP code on the web server, which typically leads to full compromise of the phpBB Plus installation and the underlying host. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.

Attack surface

Reachable over the network via HTTP by requesting the vulnerable language file with a crafted phpbb_root_path value; no authentication is required and no user interaction is needed. The CVSS 2.0 vector AV:N/AC:M/Au:N confirms network reachability with medium access complexity and no authentication.

Exploitation

Public exploit references exist (Bugtraq, SecurityFocus BID 25737, Exploit-DB 4434), and EPSS gives a 30-day probability of 0.45032 at the 98.7th percentile, indicating high predicted activity. The CVE is not listed in CISA KEV, so there is no confirmed in-the-wild exploitation record in this dataset.

What to do

• Upgrade phpBB Plus to 1.53a dated 20070922 or later, which addresses the vulnerable language file.
• If upgrade is not possible, remove or restrict access to language/lang_german/lang_main_album.php and any other language files that accept phpbb_root_path.
• Set allow_url_include=Off and allow_url_fopen=Off in php.ini to block remote file inclusion of PHP code.
• Apply a WAF rule blocking requests to language files containing phpbb_root_path values that point to external URLs.
• Restrict outbound HTTP from the web server so a successful include cannot fetch attacker-controlled code.

Detection

• Search web server logs for requests to language/lang_german/lang_main_album.php with phpbb_root_path containing http://, https://, ftp:// or other URL schemes.
• Monitor for unexpected outbound HTTP connections originating from the PHP/web server process.
• Look for newly created or modified PHP files in web-accessible directories following requests to language files.
• Alert on PHP error log entries referencing include or require failures for lang_main_album.php.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.