Vulnerability record · CVE-2008-0144 · published 8 January 2008
CVE-2008-0144: NetRisk index.php page parameter remote file inclusion
PPhprisk · Netrisk
NetRisk 1.9.7 and earlier passes the page parameter in index.php to a PHP include without validation, allowing remote file inclusion. An attacker can point page at a remote URL to execute arbitrary PHP code, and the same parameter can be abused with directory traversal for local file inclusion. The record is old and thin: no vendor fix details, no affected-version confirmation beyond the description, and the CWE entry (SQL injection) does not match the described file inclusion flaw.
Description
PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: this can also be leveraged for local file inclusion using directory traversal sequences.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote code execution with a public exploit and high EPSS, though the product is old and the record lacks patch and version detail.
What it is
NetRisk 1.9.7 and earlier passes the page parameter in index.php to a PHP include without validation, allowing remote file inclusion. An attacker can point page at a remote URL to execute arbitrary PHP code, and the same parameter can be abused with directory traversal for local file inclusion. The record is old and thin: no vendor fix details, no affected-version confirmation beyond the description, and the CWE entry (SQL injection) does not match the described file inclusion flaw.
Impact
An attacker gains remote code execution in the context of the web server, which can lead to full compromise of the NetRisk host and any data it can reach. Local file inclusion via traversal also allows reading files the web server can access.
Attack surface
Reached over the network through HTTP requests to index.php with a crafted page parameter; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.4484, ~98.7th percentile) and a public Exploit-DB entry (4833) exists, so exploitation is plausible and tooling is publicly available.
What to do
- Apply the vendor fix for NetRisk if one exists; if no patch is available, remove or replace the affected NetRisk installation.
- Disable allow_url_include and allow_url_fopen in PHP, and restrict include paths to a fixed allowlist.
- Validate and normalize the page parameter, rejecting URLs, absolute paths and traversal sequences.
- Run the web application under a low-privilege account with open_basedir set to limit file access.
- Place the application behind a WAF or reverse proxy that blocks remote URL and traversal patterns in request parameters.
Detection
- Search web logs for index.php requests where the page parameter contains http://, https://, ftp:// or ../ sequences.
- Alert on outbound HTTP connections from the web server to unexpected external hosts.
- Monitor for unexpected PHP file creation or modification in the web root and for new processes spawned by the web server user.
- Review PHP error logs for include or fopen warnings referencing remote URLs or traversal paths.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2008-0144 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2008-0144), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
