CVE-2008-5789: Joomla Feederator component PHP remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit references and high EPSS probability, though the component is an old third-party Joomla! extension.

What it is

The Recly Interactive Feederator (com_feederator) 1.0.5 component for Joomla! contains multiple PHP remote file inclusion flaws. Attackers can supply a URL through the mosConfig_absolute_path parameter in add_tmsp.php, edit_tmsp.php, tmsp.php, and subscription.php, causing the application to include and execute remote PHP code. This allows full server-side code execution against the affected component.

Impact

An unauthenticated attacker can execute arbitrary PHP code on the web server, leading to full compromise of the Joomla! site and potentially the underlying host. This typically enables data theft, web shell deployment, and lateral movement.

Attack surface

Reached over the network via HTTP requests to the vulnerable includes/tmsp/ scripts, with the malicious URL passed in the mosConfig_absolute_path or GLOBALS[mosConfig_absolute_path] parameter. No authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N.

Exploitation

Public exploit references exist (SecurityFocus BID 32194 tagged Exploit and Exploit-DB 7040), and EPSS is 0.4499 (98.7th percentile), indicating elevated likelihood of exploitation. The CVE is not listed in CISA KEV.

What to do

• Patch or upgrade the com_feederator component to a fixed version, or remove it if no fix is available.
• Disable or uninstall the vulnerable component if it is not required.
• Enforce PHP allow_url_include=Off and allow_url_fopen=Off to block remote file inclusion.
• Apply a web application firewall rule to block URL parameters containing remote scheme references in mosConfig_absolute_path.
• Restrict outbound network access from the web server to limit retrieval of attacker-hosted payloads.

Detection

• Search web server logs for requests to includes/tmsp/*.php with mosConfig_absolute_path or GLOBALS[mosConfig_absolute_path] parameters containing http:// or https:// URLs.
• Monitor for unexpected PHP files or web shells written to the Joomla! web root or upload directories.
• Alert on outbound HTTP connections from the web server to unfamiliar external hosts following component requests.
• Review PHP error logs for include or require failures referencing remote URLs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.