Multiple PHP remote file inclusion vulnerabilities in ttCMS 2.2 and ttForum allow remote attackers to execute arbitrary PHP code via the (1…

Published 22 y ago 2003-12-31 · modified 4 mo ago 2026-06-16 · JSON

CVSS

6.8

v2.0 · NVD

CISA KEV

not known exploited

EPSS

7.1%

percentile 94%

Public exploits

Exploit-DB

Multiple PHP remote file inclusion vulnerabilities in ttCMS 2.2 and ttForum allow remote attackers to execute arbitrary PHP code via the (1) template parameter in News.php or (2) installdir parameter in install.php.

Exploit prediction (EPSS)

7.07% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

Exploits and detections

EDB-22578 ttCMS 2.2 / ttForum 1.1 - 'install.php?installdir' Remote File Inclusion · webapps · 2003-05-09
EDB-22577 ttCMS 2.2 / ttForum 1.1 - 'news.php?template' Remote File Inclusion · webapps · 2003-05-09

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

exchange.xforce.ibmcloud.com /vulnerabilities/12271 · vdb-entry, x_refsource_XF, x_transferred
securityfocus.com /bid/7542 · vdb-entry, x_refsource_BID, x_transferred
securityreason.com /securityalert/3278 · third-party-advisory, x_refsource_SREASON, x_transferred
securityfocus.com /archive/1/321000 · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

CVE List: CVE-2003-1459
NVD: CVE-2003-1459

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.