CVE-2001-1236 in myphpPagetool
Summary
by MITRE
myphpPagetool PHP script 0.4.3-1 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an HTTP request that modifies the includedir variable.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/27/2025
The vulnerability described in CVE-2001-1236 represents a critical remote code execution flaw in the myphpPagetool PHP script version 0.4.3-1 and earlier. This issue stems from improper input validation and insecure file inclusion mechanisms that allow remote attackers to manipulate the application's behavior through crafted HTTP requests. The vulnerability specifically targets the includedir variable, which controls the directory from which files are included during script execution, creating a pathway for malicious code injection.
This security flaw operates through a classic insecure direct object reference pattern where user-supplied input directly influences file inclusion operations. When an attacker crafts a malicious HTTP request that modifies the includedir variable, the application fails to properly validate or sanitize this input before using it in file inclusion operations. The vulnerability is classified under CWE-98 as "Improper Control of Code Generation Tools" and more specifically as CWE-225 as "Improper Neutralization of Special Elements used in an OS Command." The attack vector leverages the lack of proper input validation, allowing attackers to specify arbitrary remote URLs that are then included and executed as PHP code on the target server.
The operational impact of this vulnerability is severe and far-reaching, as it provides attackers with complete control over the affected system. Remote code execution allows malicious actors to execute arbitrary commands on the server, potentially leading to data breaches, system compromise, and further lateral movement within network infrastructures. The vulnerability affects web applications running vulnerable versions of myphpPagetool, which were commonly used for content management and web publishing tasks. Attackers can leverage this flaw to upload backdoors, steal sensitive information, modify website content, or use the compromised server as a launchpad for attacks against other systems.
Mitigation strategies for CVE-2001-1236 should focus on immediate patching of the vulnerable software to version 0.4.3-2 or later, which contains fixes for the insecure file inclusion vulnerability. Organizations should also implement proper input validation and sanitization for all user-supplied data, particularly parameters that influence file inclusion operations. The principle of least privilege should be enforced by restricting file inclusion paths to predefined safe directories and implementing proper access controls. Network-based mitigations include firewall rules that restrict access to vulnerable applications and implementing web application firewalls that can detect and block malicious inclusion attempts. Additionally, security monitoring should be enhanced to detect unusual file inclusion patterns and unauthorized code execution attempts. This vulnerability aligns with ATT&CK technique T1059.007 for "Command and Scripting Interpreter: PowerShell" and T1190 for "Exploit Public-Facing Application," demonstrating how insecure file inclusion can enable multiple attack vectors and lateral movement within compromised environments.