CVE-2010-2677: PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quot...

Security readout for executives and security teams

CVE-2010-2677 is a remote file inclusion issue in Open Web Analytics 1.2.3. Under specific legacy PHP settings, a remote attacker could cause the application to execute attacker-controlled PHP code. The bundle includes public exploit references, but no CISA KEV listing or other evidence of active exploitation. Exposure is most likely on legacy OWA 1.2.3 deployments running old PHP configurations where register_globals is enabled. Internet-facing analytics installations would carry higher business risk. The source bundle does not identify later affected versions. Prioritize if OWA 1.2.3 is internet-facing or business-critical. The vulnerability can enable code execution, but exposure depends on legacy PHP settings and an old product version. Mitigation focus: Identify any Open Web Analytics 1.2.3 deployments.; Check vendor guidance for fixed versions or replacement recommendations.; Disable register_globals on any legacy PHP runtime..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.