CVE-2007-1895

CVE-2007-1895 is a remote file inclusion vulnerability affecting Sky GUNNING MySpeach version 3.0.7 and earlier, specifically when running on PHP 5. An attacker can exploit this by injecting an FTP URL into the my_ms[root] cookie, leading to the execution of arbitrary PHP code on the server. With a CVSS score of 6.8, this vulnerability is of medium severity, requiring moderate attack complexity but allowing for partial confidentiality, integrity, and availability impacts. The attack vector is network-based, meaning it can be exploited remotely without authentication. While not listed on the CISA KEV catalog, public exploit code exists on ExploitDB, indicating its potential for exploitation. Despite this, there is no evidence of active exploitation, and it has received minimal community discussion or media coverage.