CVE-2007-5440

CVE-2007-5440 describes multiple remote file inclusion (RFI) vulnerabilities in CRS Manager, specifically affecting index.php and login.php. Attackers could exploit this by injecting a malicious URL into the DOCUMENT_ROOT parameter, leading to arbitrary PHP code execution. With a CVSS score of 7.5, this vulnerability is considered highly severe due to its network-based attack vector, low attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. While the CVE description notes a dispute regarding the attacker's ability to modify DOCUMENT_ROOT, public exploit code exists on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.