Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

PHPHD Download System can run remote code via crafted URL

CVE-2007-2096 · published 19 years ago
Summary

The Hinton Design PHPHD Download System allows someone to provide a web address that the program treats like a local file. By doing this, an attacker can cause the server to run any code they choose, potentially taking control of the site or stealing information. Install the latest version from the vendor, or if none is available, stop the program from loading external addresses and use a web firewall to block such requests.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hinton_design phphd_download_system All versions
cpe:2.3:a:hinton_design:phphd_download_system:*:*:*:*:*:*:*:*
Original advisory text
PHP remote file inclusion vulnerability in common.php in Hinton Design PHPHD Download System (phphd_downloads) allows remote attackers to execute arbitrary PHP code via a URL in the phphd_real_path...
PHP remote file inclusion vulnerability in common.php in Hinton Design PHPHD Download System (phphd_downloads) allows remote attackers to execute arbitrary PHP code via a URL in the phphd_real_path parameter. NOTE: this issue may be present in versions from 2006.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Timeline
Published18 Apr 2007
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2007-2096 · NVD
Track software like this
Free during beta