CVE-2007-2774

SunLight CMS 5.3 - Remote File Inclusion via Root Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-2774. PoCs published by Mehmet Ince.

AI-analyzed exploit summary This is a writeup describing a Remote File Inclusion (RFI) vulnerability in SunLight CMS 5.3 and earlier. It details vulnerable code snippets and example exploit URLs but does not include functional exploit code.

Description

Multiple PHP remote file inclusion vulnerabilities in SunLight CMS 5.3 allow remote attackers to execute arbitrary PHP code via a URL in the root parameter to (1) _connect.php or (2) modules/startup.php.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Mehmet Ince · textwebappsphp

https://www.exploit-db.com/exploits/3953

View Code ZIP pw:eip

This is a writeup describing a Remote File Inclusion (RFI) vulnerability in SunLight CMS 5.3 and earlier. It details vulnerable code snippets and example exploit URLs but does not include functional exploit code.

Classification

Writeup 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Theoretical

Target: SunLight CMS <= 5.3

No auth needed

Prerequisites: A vulnerable SunLight CMS installation with exposed _connect.php or modules/startup.php · Ability to host a malicious script on a remote server

MITRE ATT&CK

T1189 - Drive-by Compromise T1204.001 - Malicious Link

devstral-2 · analyzed Feb 16, 2026 Full analysis →