CVE-2007-1701: Medium severity PHP PHP vulnerability
Published Mar 27, 2007
·Updated
PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when registerglobals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling sessiondecode on a string beginning with "SESSION|s:39:".
Affected Software
2 affected components
PHP PHP>=4.0.0<4.4.5
PHP PHP>=5.0.0<5.2.1
Event History
Mar 27, 2007
CVE Published
01:19 AM
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-1701?
CVE-2007-1701 has a high severity due to the potential for remote code execution.
2
How do I fix CVE-2007-1701?
To fix CVE-2007-1701, upgrade to PHP 4.4.5 or later, or PHP 5.2.1 or later.
3
Which versions of PHP are affected by CVE-2007-1701?
CVE-2007-1701 affects PHP versions before 4.4.5 and 5.2.1 when register_globals is enabled.
4
What vulnerability does CVE-2007-1701 exploit?
CVE-2007-1701 exploits a deserialization flaw that allows attackers to overwrite global variables.
5
Is register_globals a security risk related to CVE-2007-1701?
Yes, having register_globals enabled is a significant security risk related to CVE-2007-1701.