CVE-2007-1700

2007-03-2701:19:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

php

session

extension

vulnerability

code execution

crafted string

security

cve-2007-1700

7.1 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.027 Low

EPSS

Percentile

90.3%

JSON

The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session variables without considering the internal pointer from the session globals, which allows context-dependent attackers to execute arbitrary code via a crafted string in the session_register after unsetting HTTP_SESSION_VARS and _SESSION, which destroys the session data Hashtable.

CPENameOperatorVersion
php:phpphpeq4.3.9
php:phpphpeq4.0
php:phpphpeq5.1.5
php:phpphpeq5.1.2
php:phpphpeq4.2.0
php:phpphpeq5.1.1
php:phpphpeq4.4.4
php:phpphpeq5.0.0
php:phpphpeq4.1.0
php:phpphpeq5.1.6

CPE	Name	Operator	Version
php:php	php	eq	4.3.9
php:php	php	eq	4.0
php:php	php	eq	5.1.5
php:php	php	eq	5.1.2
php:php	php	eq	4.2.0
php:php	php	eq	5.1.1
php:php	php	eq	4.4.4
php:php	php	eq	5.0.0
php:php	php	eq	4.1.0
php:php	php	eq	5.1.6