CVE-2007-3997: SQL Injection
Published Sep 4, 2007
·Updated
The (1) MySQL and (2) MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safemode and openbasedir restrictions via MySQL LOCAL INFILE operations, as demonstrated by a query with LOAD DATA LOCAL INFILE.
Affected Software
2 affected components
PHP PHP>=4.0.0<4.4.8
PHP PHP>=5.0.0<5.2.4
Event History
Sep 4, 2007
CVE Published
06:17 PM
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-3997?
CVE-2007-3997 is considered a critical vulnerability due to its ability to bypass security restrictions.
2
How do I fix CVE-2007-3997?
To fix CVE-2007-3997, upgrade PHP to version 4.4.8 or 5.2.4 or later.
3
Which PHP versions are affected by CVE-2007-3997?
CVE-2007-3997 affects PHP versions prior to 4.4.8 and 5.2.4.
4
What are the risks associated with CVE-2007-3997?
The risks include unauthorized file access and potential data theft due to the bypass of safe_mode and open_basedir restrictions.
5
Can CVE-2007-3997 be exploited remotely?
Yes, attackers can exploit CVE-2007-3997 remotely through MySQL LOCAL INFILE operations.