CVE-2008-5053: Joomla Simple RSS Reader component remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the component is an old third-party Joomla extension rather than core.

What it is

The Simple RSS Reader (com_rssreader) 1.0 component for Joomla! contains a remote file inclusion flaw in admin.rssreader.php. The mosConfig_live_site parameter is used to include a remote file without validation, letting an attacker pull in and execute arbitrary PHP code. It matters because the component is reachable over the network and the flaw yields full code execution on the web server.

Impact

An attacker gains arbitrary PHP code execution in the context of the web server, leading to full compromise of confidentiality, integrity and availability of the affected site.

Attack surface

Reached remotely over HTTP by supplying a crafted URL in the mosConfig_live_site parameter to admin.rssreader.php. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.63276 (99.17th percentile) and a public Exploit-DB entry plus a SecurityFocus reference tagged Exploit exist, so working exploit code is publicly available.

What to do

• Patch or remove the vulnerable Simple RSS Reader (com_rssreader) 1.0 component; no fixed version is stated in the record, so confirm vendor status before relying on an upgrade.
• If the component is not needed, uninstall it and remove admin.rssreader.php from the web root.
• Disable allow_url_include and allow_url_fopen in PHP to block remote file inclusion.
• Restrict outbound HTTP from the web server and enforce a web application firewall rule blocking URL values in mosConfig_live_site.
• Audit the Joomla installation for other components with unvalidated include parameters.

Detection

• Search web server logs for requests to admin.rssreader.php with mosConfig_live_site containing http:// or https:// URLs.
• Monitor for unexpected outbound HTTP connections from the web server to external hosts.
• Look for newly written or modified PHP files in the Joomla web root and upload directories.
• Alert on PHP include or require errors referencing remote URLs in application logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.