CVE-2008-1505: Joomla SSTREAMTV custompages component remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the affected component is old and niche.

What it is

The SSTREAMTV custompages (com_custompages) component 1.1 and earlier for Joomla! passes the cpage parameter from index.php into a PHP include without validation, allowing remote file inclusion. An attacker can point that parameter at a remote file and have the server execute arbitrary PHP code, so any site running the vulnerable component is exposed to full compromise.

Impact

An attacker gains remote code execution in the context of the web server, enabling arbitrary PHP execution, data theft, and further host or site takeover.

Attack surface

Reached over the network through index.php with a crafted cpage parameter; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

No CISA KEV listing, but EPSS is 0.46103 (98.8th percentile) and references carry an Exploit tag plus an Exploit-DB entry, indicating public exploit code exists.

What to do

• Apply the vendor fix for the custompages component or upgrade to a version later than 1.1; if no patch is available, remove or disable the component.
• Validate and whitelist the cpage parameter so it cannot contain URLs or path traversal, and disable allow_url_include and allow_url_fopen in PHP.
• Restrict outbound network access from the web server to limit retrieval of attacker-hosted payloads.
• Run the Joomla site under a least-privilege account with open_basedir and disable dangerous PHP functions where feasible.

Detection

• Search web and PHP logs for requests to index.php with a cpage parameter containing http://, https://, ftp://, or other URL schemes.
• Monitor for unexpected outbound HTTP requests originating from the web server process.
• Look for newly written or modified PHP files in Joomla directories and for unusual child processes spawned by the web server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.