CVE-2009-4223: KR-Web krgourl.php remote file inclusion allows PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution with a public exploit and very high EPSS score, though the product is old and not in KEV.

What it is

KR-Web 1.1b2 and earlier contains a remote file inclusion flaw in adm/krgourl.php where the DOCUMENT_ROOT parameter is used without validation. An attacker can supply a remote URL that causes the application to include and execute arbitrary PHP code. The record is old and thin, but the flaw type and vector are clearly stated.

Impact

An unauthenticated remote attacker can execute arbitrary PHP code on the server, leading to full compromise of the web application and potentially the underlying host.

Attack surface

Reachable over the network via HTTP requests to adm/krgourl.php with a crafted DOCUMENT_ROOT parameter. No authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N.

Exploitation

A public exploit exists in Exploit-DB (reference tagged Exploit), and EPSS is 0.54584 (98.9th percentile), indicating elevated likelihood of exploitation. The CVE is not listed in CISA KEV.

What to do

• Upgrade or remove KR-Web; the affected version is 1.1b2 and earlier and no fixed version is stated in the record.
• Disable PHP allow_url_include and allow_url_fopen where possible to block remote file inclusion.
• Restrict adm/ directory access via web server rules and require authentication for administrative scripts.
• Validate and sanitize the DOCUMENT_ROOT parameter, rejecting URL input.
• Monitor and block outbound HTTP requests from the web server to untrusted hosts.

Detection

• Search web server logs for requests to adm/krgourl.php with DOCUMENT_ROOT containing http:// or https:// URLs.
• Alert on PHP include or require errors referencing remote URLs in application logs.
• Monitor for unexpected outbound HTTP connections from the web server process.
• Use file integrity monitoring to detect newly written PHP files in web-accessible directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.