Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Webmobo WB News lets attackers run code via URL

CVE-2007-1288 · published 19 years ago
Summary

The WB News 1.4.1 and earlier versions let an attacker supply a web address in certain admin pages, causing the server to load and run that external code. This can give the attacker full control over the website and any data it handles. Update to the latest safe version or apply the vendor's patch as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
webmobo wbnews <= 1.4.1
cpe:2.3:a:webmobo:wbnews:*:*:*:*:*:*:*:*
Original advisory text
Multiple PHP remote file inclusion vulnerabilities in Webmobo WB News 1.4.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config[installdir] parameter to (1) com...
Multiple PHP remote file inclusion vulnerabilities in Webmobo WB News 1.4.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config[installdir] parameter to (1) comment.php, (2) themes.php, (3) directory.php, and (4) sendmsg.php in admin/.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
3% chance of attack within 30 days
Timeline
Published7 Mar 2007
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2007-1288 · NVD
Track software like this
Free during beta