PHP remote file inclusion vulnerability in visitor.php in Butterfly online visitors counter 1.08, when used with certain older versions of…

Description

PHP remote file inclusion vulnerability in visitor.php in Butterfly online visitors counter 1.08, when used with certain older versions of PHP with improper SERVER superglobal handling, allows remote attackers to execute arbitrary PHP code via a URL in the _SERVER[DOCUMENT_ROOT] parameter. NOTE: it could be argued that this vulnerability is caused by a problem in PHP and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Butterfly online visitors counter.

Scores

EPSS (exploitation in 30 days)

1.8% · top 22% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (6)

• http://securityvulns.com/Rdocument845.html (opens in a new tab)x_refsource_MISCx_transferred
• 20070821 Vulnerabilities digest (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 20071010 Vulnerabilities digest (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• butterfly-visitor-file-include(36147) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• http://securityvulns.com/source26994.html (opens in a new tab)x_refsource_MISCx_transferred
• 38327 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2007-4485](https://trackcve.app/badge/CVE-2007-4485.svg)](https://trackcve.app/cve/CVE-2007-4485)

Record last updated 7 Aug 2024, 14:53 UTC.