CVE-2007-4279: PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31 allows remote attack...

Security readout for executives and security teams

This is an old FrontAccounting vulnerability where a web request can make the application load PHP code from a remote URL. If the vulnerable 1.12 Build 31 deployment is internet-facing, compromise could mean server-side code execution. The bundle does not provide CVSS, a vendor fix, or current exploitation evidence. Likely exposure is limited to organizations still running FrontAccounting 1.12 Build 31, or code derived from that vulnerable config.php, especially if reachable from the internet. The provided affected-product metadata is incomplete, so do not assume other versions are affected without vendor or source confirmation. Prioritize if FrontAccounting is present, especially on public systems. The issue is old, but the consequence is server-side code execution and a public exploit reference exists. If the product is not deployed, no direct action is needed beyond confirming inventory accuracy. Mitigation focus: Inventory FrontAccounting deployments and identify any 1.12 Build 31 instances.; Check FrontAccounting or vendor guidance for fixed versions or retirement guidance.; Restrict public access to suspected vulnerable deployments until verified..

Prepared

Jun 29, 2026, 04:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.