CVE-2007-5097
9.8 · CRITICALPHP remote file inclusion vulnerability in lib/classes/offl_nflteam.php in Online Fantasy Football League (OFFL) 0.2.6 allows remote attackers to execute arbitrary PHP code via a URL in the DOC_ROO…
Overview
CVE-2007-5097 is a critical-severity vulnerability affecting online_fantasy_football_league offl. It was published on September 26, 2007 and has a CVSS 3.1 base score of 9.8 (CRITICAL).
This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
Technical description
PHP remote file inclusion vulnerability in lib/classes/offl_nflteam.php in Online Fantasy Football League (OFFL) 0.2.6 allows remote attackers to execute arbitrary PHP code via a URL in the DOC_ROOT parameter. NOTE: this issue is disputed by CVE because a __FILE__ test protects offl_nflteam.php against direct requests
Remediation
Check the references section for vendor advisories and patches from online_fantasy_football_league. Update offl to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected products
| Vendor | Product | Versions | Status |
|---|
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-2007-5097?
CVE-2007-5097 is a critical-severity vulnerability affecting online_fantasy_football_league offl. It was published on September 26, 2007 and has a CVSS 3.1 base score of 9.8 (CRITICAL).
How severe is CVE-2007-5097?
This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2007-5097?
Check the references section for vendor advisories and patches from online_fantasy_football_league. Update offl to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2007-5097?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2007-5097 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related CRITICAL CVEs from 2007
View all- 9.8CVE-2007-0681
profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrar
View details - 9.8CVE-2006-6975
PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.3 allows remote atta
View details - 9.8CVE-2006-7079
Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote at
View details - 9.8CVE-2006-7105
PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attac
View details - 9.8CVE-2007-1383
Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attacker
View details - 9.8CVE-2007-1399
Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with
View details - 9.8CVE-2007-2020
Unspecified vulnerability in administration.php in xodagallery allows remote attackers to execute ar
View details - 9.8CVE-2007-2422
Multiple PHP remote file inclusion vulnerabilities in Modules Builder (modbuild) 4.1 for Comdev One
View details - 9.8CVE-2007-2534
Multiple SQL injection vulnerabilities in admin.php in phpHoo3 allow remote attackers to execute arb
View details - 9.8CVE-2007-3194
Multiple PHP remote file inclusion vulnerabilities in myBloggie 2.1.5 allow remote attackers to exec
View details - 9.8CVE-2007-3798
Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote atta
View details - 9.8CVE-2007-4039
Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote
View details