CVE-2007-1708: PHP remote file inclusion vulnerability in lib/db/ez_sql.php in ttCMS 4 and earlier allows remote attackers...

Security readout for executives and security teams

CVE-2007-1708 is an old remote file inclusion flaw in ttCMS 4 and earlier. A remote attacker could make the application include attacker-controlled PHP through the lib_path parameter, which can lead to arbitrary PHP code execution. The source bundle does not provide CVSS scoring or a vendor patch. Exposure is likely limited to legacy ttCMS 4 or earlier deployments, especially internet-facing instances. The bundle lists affected vendor/product metadata as n/a, so asset validation must rely on application inventory, version checks, and path/code review. Treat this as high priority if ttCMS is still present, because the stated impact is arbitrary PHP code execution. If no ttCMS 4 or earlier assets exist, business urgency is low but should be documented. Mitigation focus: Identify and prioritize any ttCMS 4 or earlier deployments.; Check ttCMS or archived vendor guidance for fixed versions or official workarounds.; Replace or retire unsupported ttCMS instances where no maintained fix exists..

Prepared

Jun 29, 2026, 06:37 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.