CVE-2007-0167
Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed...
Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow remote attackers to execute arbitrary PHP code via a URL in the INC parameter in (1) config_admin.php, (2) config_main.php, (3) config_member.php, and (4) mysql_config.php in config/; (5) admin.php and (6) index.php in admini/; (7) paypalipn/ipnprocess.php; (8) index.php and (9) registration.php in members/; and (10) ppcbannerclick.php and (11) ppcclick.php in main/.
Exploit likelihood
What each source reports
NVD Score used
Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow remote attackers to execute arbitrary PHP code via a URL in the INC parameter in (1) config_admin.php, (2) config_main.php, (3) config_member.php, and (4) mysql_config.php in config/; (5) admin.php and (6) index.php in admini/; (7) paypalipn/ipnprocess.php; (8) index.php and (9) registration.php in members/; and (10) ppcbannerclick.php and (11) ppcclick.php in main/.
- Record
CVE-2007-0167- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow remote attackers to execute arbitrary PHP code via a URL in the INC parameter in (1) config_admin.php, (2) config_main.php, (3) config_member.php, and (4) mysql_config.php in config/; (5) admin.php and (6) index.php in admini/; (7) paypalipn/ipnprocess.php; (8) index.php and (9) registration.php in members/; and (10) ppcbannerclick.php and (11) ppcclick.php in main/.
- Record
CVE-2007-0167- Updated
- 2026-11-02
EUVDEUVD-2007-0171 No score
Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow remote attackers to execute arbitrary PHP code via a URL in the INC parameter in (1) config_admin.php, (2) config_main.php, (3) config_member.php, and (4) mysql_config.php in config/; (5) admin.php and (6) index.php in admini/; (7) paypalipn/ipnprocess.php; (8) index.php and (9) registration.php in members/; and (10) ppcbannerclick.php and (11) ppcclick.php in main/.
- Record
EUVD-2007-0171- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x9w2-g9gv-85xr No score
Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed...
Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow remote attackers to execute arbitrary PHP code via a URL in the INC parameter in (1) config_admin.php, (2) config_main.php, (3) config_member.php, and (4) mysql_config.php in config/; (5) admin.php and (6) index.php in admini/; (7) paypalipn/ipnprocess.php; (8) index.php and (9) registration.php in members/; and (10) ppcbannerclick.php and (11) ppcclick.php in main/.
- Record
GHSA-x9w2-g9gv-85xr- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | PPC Search Engine 1.61 - 'INC' Multiple Remote File Inclusions | 2007-01-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-0167 is a high vulnerability (CVSS 7.5) in Ppc Search Engine Search Engine, published January 10, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.5%, the 95th percentile. No source names a fixed version.
References
exploit-db.com/exploits/3104
osvdb.org/33449
securityreason.com/securityalert/2134
Show 13 moreShow less
securityfocus.com/bid/21961
attrition.org/pipermail/vim/2007-January/001221.html
exchange.xforce.ibmcloud.com/vulnerabilities/31355
nvd.nist.gov/vuln/detail/CVE-2007-0167
github.com/advisories/GHSA-x9w2-g9gv-85xr