{"id":"CVE-2007-1790","url":"https://www.cyber-defence.io/tools/cve/CVE-2007-1790","generatedAt":"2026-10-27T18:33:11.979Z","title":"Multiple PHP remote file inclusion vulnerabilities in Kaqoo Auction Software Free Edition allow remote attackers to execute arbitrary PHP code via a URL in the install_root parameter to (1) support.inc.php, (2) function.inc.php, (3) rdal_object.inc.php,…","description":"Multiple PHP remote file inclusion vulnerabilities in Kaqoo Auction Software Free Edition allow remote attackers to execute arbitrary PHP code via a URL in the install_root parameter to (1) support.inc.php, (2) function.inc.php, (3) rdal_object.inc.php, (4) rdal_editor.inc.php. (5) login.inc.php, (6) request.inc.php, and (7) categories.inc.php in include/core/; (8) save.inc.php, (9) preview.inc.php, (10) edit_item.inc.php, (11) new_item.inc.php, and (12) item_info.inc.php in include/display/item/; (13) search.inc.php, (14) item_edit.inc.php, (15) register_succsess.inc.php, (16) context_menu.inc.php, (17) item_repost.inc.php, (18) balance.inc.php, (19) featured.inc.php, (20) user.inc.php, (21) buynow.inc.php, (22) install_complete.inc.php, (23) fees_info.inc.php, (24) user_feedback.inc.php, (25) admin_balance.inc.php, (26) activate.inc.php, (27) user_info.inc.php, (28) member.inc.php, (29) add_bid.inc.php, (30) items_filter.inc.php, (31) my_info.inc.php, (32) register.inc.php, (33) leave_feedback.inc.php, and (34) user_auctions.inc.php in include/display/; and (35) design/form.inc.php, (36) processor.inc.php, (37) interfaces.inc.php (38) left_menu.inc.php, (39) login.inc.php, and (40) categories.inc.php in include/.","published":"2007-03-31T10:19:00.000Z","lastModified":"2026-06-16T22:38:18.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":6.8,"severity":"MEDIUM","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P"},"cwe":["CWE-94"],"affected":["kaqoo/kaqoo auction software"],"epss":{"score":0.07034,"percentile":0.94141,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2007-03-29","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":3607,"kind":"exploit","title":"Kaqoo Auction - 'install_root' Multiple Remote File Inclusions","url":"https://www.exploit-db.com/exploits/3607","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/3607.txt","file":"exploits/php/webapps/3607.txt","published":"2007-03-29","added":"2007-03-28","updated":null,"author":"ThE dE@Th","type":"webapps","platform":"php","port":null,"verified":true,"codes":["OSVDB-34584","CVE-2007-1790","OSVDB-34583","OSVDB-34582","OSVDB-34581","OSVDB-34580","OSVDB-34579","OSVDB-34578","OSVDB-34577","OSVDB-34576","OSVDB-34575","OSVDB-34574","OSVDB-34573","OSVDB-34572","OSVDB-34571","OSVDB-34570","OSVDB-34569","OSVDB-34568","OSVDB-34567","OSVDB-34566","OSVDB-34565","OSVDB-34564","OSVDB-34563","OSVDB-34562","OSVDB-34561","OSVDB-34560","OSVDB-34559","OSVDB-34558","OSVDB-34557","OSVDB-34556","OSVDB-34555","OSVDB-34554","OSVDB-34553","OSVDB-34552","OSVDB-34551","OSVDB-34550","OSVDB-34549","OSVDB-34548","OSVDB-34547","OSVDB-34546","OSVDB-34545"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"high","text":"A public exploit is published in Exploit-DB (verified), so the technical barrier is gone even though the severity is medium and EPSS is 7.0%. Treat it as high on anything reachable from the internet."},"changes":[],"references":[{"url":"http://secunia.com/advisories/24696","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34545","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34546","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34547","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34548","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34549","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34550","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34551","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34552","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34553","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34554","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34555","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34556","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34557","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34558","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34559","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34560","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34561","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34562","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34563","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34564","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34565","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34566","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34567","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34568","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34569","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34570","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34571","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34572","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34573","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34574","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34575","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34576","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34577","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34578","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34579","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34580","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34581","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34582","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34583","source":"cve@mitre.org"},{"url":"http://www.osvdb.org/34584","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/23211","source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2007/1180","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33335","source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/3607","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/24696","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34545","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34546","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34547","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34548","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34549","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34550","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34551","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34552","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34553","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34554","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34555","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34556","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34557","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/34558","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-1790","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}