CVE-2007-2369

WebSPELL < 4.01.02 - Directory Traversal via Picture.php ID Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-2369. PoCs published by Trex.

AI-analyzed exploit summary The code describes two file disclosure vulnerabilities in WebSPELL <= 4.01.02 via the 'picture.php' script. Vulnerability 1 requires 'register_globals' to be enabled, while Vulnerability 2 relies on PHP versions < 4.3.0. Both allow arbitrary file reads via path traversal.

Description

Directory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.3.0 is used, allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Trex · textwebappsphp
https://www.exploit-db.com/exploits/3673

The code describes two file disclosure vulnerabilities in WebSPELL <= 4.01.02 via the 'picture.php' script. Vulnerability 1 requires 'register_globals' to be enabled, while Vulnerability 2 relies on PHP versions < 4.3.0. Both allow arbitrary file reads via path traversal.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: WebSPELL <= 4.01.02
No auth needed
Prerequisites: PHP register_globals enabled (Vulnerability 1) · PHP version < 4.3.0 (Vulnerability 2)
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/34638
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/1274
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/3673

Scores

EPSS 0.0843
EPSS Percentile 94.3%

Details

Status published
Products (2)
php/php < 4.2.3
webspell/webspell < 4.01.02
Published Apr 30, 2007
Tracked Since Feb 18, 2026