CVE-2008-1043: LWS php User Base header.inc.php remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the product is old and no KEV listing exists.

What it is

Linux Web Shop php User Base 1.3 BETA includes templates/default/header.inc.php in a way that lets the menu parameter supply a remote URL, so attacker-controlled PHP is fetched and executed. This is a classic remote file inclusion that turns into arbitrary code execution on the web server. The record is old and thin: no fixed version is named and no vendor advisory is present.

Impact

An unauthenticated attacker can run arbitrary PHP code with the privileges of the web server, leading to full compromise of the application and potentially the host.

Attack surface

Reachable over the network through the menu parameter of templates/default/header.inc.php; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.48595 (98.8th percentile) and an Exploit-DB entry (5180) exists, so public exploit code is available and exploitation is plausible.

What to do

• Apply the vendor fix for php User Base if one exists; the record names no patched version, so confirm with the vendor or replace the product.
• Disable allow_url_include and allow_url_fopen in PHP to block remote file inclusion.
• Validate and whitelist the menu parameter, rejecting any URL or path input.
• Remove or isolate the affected templates/default/header.inc.php if the product is no longer maintained.
• Run the web application with least privilege and restrict outbound network access from the web server.

Detection

• Search web logs for requests to templates/default/header.inc.php with a menu parameter containing http:// or https://.
• Monitor for outbound HTTP requests originating from the web server process to unexpected hosts.
• Alert on PHP processes spawning shells or writing files in web-accessible directories.
• Review file integrity of templates/default/header.inc.php and other application files for unexpected changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.