Vulnerability record · CVE-2007-5842 · published 6 November 2007
CVE-2007-5842: Vortex Portal PHP remote file inclusion in auth scripts
VVortex Portal · Vortex Portal
Vortex Portal 1.0.42 contains multiple PHP remote file inclusion flaws in admincp/auth/secure.php and admincp/auth/checklogin.php. The cfgProgDir parameter is used to include a remote file without validation, letting an attacker supply a URL that is executed as PHP code. This matters because successful exploitation yields arbitrary code execution on the web server.
Description
Multiple PHP remote file inclusion vulnerabilities in Vortex Portal 1.0.42 allow remote attackers to execute arbitrary PHP code via a URL in the cfgProgDir parameter to (1) admincp/auth/secure.php or (2) admincp/auth/checklogin.php.
AV:N/AC:M/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated code execution with public exploit code and high EPSS, though the CVSS 2.0 score is only 6.8 and the product is old.
What it is
Vortex Portal 1.0.42 contains multiple PHP remote file inclusion flaws in admincp/auth/secure.php and admincp/auth/checklogin.php. The cfgProgDir parameter is used to include a remote file without validation, letting an attacker supply a URL that is executed as PHP code. This matters because successful exploitation yields arbitrary code execution on the web server.
Impact
An attacker can execute arbitrary PHP code on the server, leading to full compromise of the web application and potentially the underlying host.
Attack surface
Reachable over the network via HTTP requests to the two admincp/auth scripts, with no authentication required per the CVSS vector (Au:N). No user interaction is indicated.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.46461, 98.8th percentile) and a public Exploit-DB entry (4605) exists, indicating exploit code is available.
What to do
- Apply the vendor patch or upgrade Vortex Portal beyond 1.0.42 if available; if no patch exists, remove or disable the affected admincp/auth scripts.
- Disable allow_url_include and allow_url_fopen in PHP to block remote file inclusion.
- Restrict access to admincp/auth/ paths by IP or authentication at the web server layer.
- Run the application with least privilege and enforce a PHP open_basedir restriction.
- Deploy a WAF rule blocking URL values in the cfgProgDir parameter.
Detection
- Search web logs for requests to admincp/auth/secure.php or checklogin.php with cfgProgDir containing http:// or https://.
- Monitor for outbound HTTP requests from the web server to unexpected external hosts.
- Alert on PHP errors or file inclusion warnings referencing remote URLs in these scripts.
- Review file integrity and process creation on the web host for unexpected PHP execution.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-5842 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-5842), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
