CVE-2007-5098: DFD Cart PHP remote file inclusion via set_depth parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution with public exploit code and high EPSS, though exploitation requires register_globals to be enabled.

What it is

DFD Cart 1.1.4 and earlier contains multiple PHP remote file inclusion flaws in product.control and customer.area scripts. When register_globals is enabled, the set_depth parameter can carry a remote URL that is included and executed as PHP. This allows arbitrary code execution on the web server.

Impact

An attacker can execute arbitrary PHP code with the web server's privileges, leading to full compromise of the application and potentially the host. Data confidentiality, integrity and availability are all affected.

Attack surface

Reachable over the network via HTTP requests to the affected PHP scripts with a crafted set_depth parameter. No authentication is required, but exploitation depends on the PHP register_globals setting being enabled.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.45953, 98.75th percentile) and a public Exploit-DB entry (4451) exists, indicating known exploit code is available.

What to do

• Upgrade DFD Cart to a version later than 1.1.4 if one exists, or migrate off the product since it is legacy and unsupported.
• Disable register_globals in php.ini and restart the web server.
• Block outbound and inbound inclusion of remote URLs by setting allow_url_include=Off and allow_url_fopen=Off.
• Restrict access to the affected app.lib/product.control and customer.area scripts via web server rules or WAF signatures.
• Run the application with least-privilege file system and database accounts.

Detection

• Search web logs for requests to product.control/config.php, customer.browse.list.php or customer.browse.search.php with set_depth containing http:// or https:// URLs.
• Alert on PHP include/require errors referencing remote hosts in application error logs.
• Monitor for unexpected outbound HTTP requests originating from the web server process.
• Use file integrity monitoring on web-accessible PHP files to catch dropped webshells.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.