CVE-2007-3205: Medium severity PHP PHP vulnerability
The parsestr function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.32-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.4.14-3
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3205?
CVE-2007-3205 is considered a medium severity vulnerability due to its potential for allowing arbitrary variable overwrites.
How do I fix CVE-2007-3205?
To fix CVE-2007-3205, ensure that the parse_str function is called with a second parameter to prevent variable overwriting.
Which versions of PHP are affected by CVE-2007-3205?
CVE-2007-3205 affects various versions of PHP, including Hardened-PHP and Suhosin implementations.
Can CVE-2007-3205 be exploited remotely?
Yes, CVE-2007-3205 can be exploited remotely by attackers to manipulate variable values in the server's environment.
Is there any recommended software to mitigate CVE-2007-3205?
Upgrading to the latest versions of PHP and using proper coding practices can help mitigate the risks associated with CVE-2007-3205.