CVE-2007-3194
9.8 · CRITICALMultiple PHP remote file inclusion vulnerabilities in myBloggie 2.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the bloggie_root_path parameter to (1) config.php; (2) db.php…
Overview
CVE-2007-3194 is a critical-severity vulnerability affecting mywebland mybloggie. It was published on June 12, 2007 and has a CVSS 3.1 base score of 9.8 (CRITICAL).
This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
Technical description
Multiple PHP remote file inclusion vulnerabilities in myBloggie 2.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the bloggie_root_path parameter to (1) config.php; (2) db.php, (3) template.php, (4) functions.php, and (5) classes.php in includes/; (6) viewmode.php; and (7) blog_body.php. NOTE: another researcher disputes the vulnerability because the files are protected against direct requests, contain no relevant include statements, or do not exist
Remediation
Check the references section for vendor advisories and patches from mywebland. Update mybloggie to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected products
| Vendor | Product | Versions | Status |
|---|
References
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-2007-3194?
CVE-2007-3194 is a critical-severity vulnerability affecting mywebland mybloggie. It was published on June 12, 2007 and has a CVSS 3.1 base score of 9.8 (CRITICAL).
How severe is CVE-2007-3194?
This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2007-3194?
Check the references section for vendor advisories and patches from mywebland. Update mybloggie to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2007-3194?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2007-3194 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related CRITICAL CVEs from 2007
View all- 9.8CVE-2007-0681
profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrar
View details - 9.8CVE-2006-6975
PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.3 allows remote atta
View details - 9.8CVE-2006-7079
Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote at
View details - 9.8CVE-2006-7105
PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attac
View details - 9.8CVE-2007-1383
Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attacker
View details - 9.8CVE-2007-1399
Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with
View details - 9.8CVE-2007-2020
Unspecified vulnerability in administration.php in xodagallery allows remote attackers to execute ar
View details - 9.8CVE-2007-2422
Multiple PHP remote file inclusion vulnerabilities in Modules Builder (modbuild) 4.1 for Comdev One
View details - 9.8CVE-2007-2534
Multiple SQL injection vulnerabilities in admin.php in phpHoo3 allow remote attackers to execute arb
View details - 9.8CVE-2007-3798
Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote atta
View details - 9.8CVE-2007-4039
Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote
View details - 9.8CVE-2007-4043
file.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) before 4.6.3 allows re
View details