CVE-2007-4528: Medium severity PHP PHP vulnerability
The Foreign Function Interface (ffi) extension in PHP 5.0.5 does not follow safemode restrictions, which allows context-dependent attackers to execute arbitrary code by loading an arbitrary DLL and calling a function, as demonstrated by kernel32.dll and the WinExec function. NOTE: this issue does not cross privilege boundaries in most contexts, so perhaps it should not be included in CVE.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-4528?
The severity of CVE-2007-4528 is considered critical due to the potential for arbitrary code execution.
How do I fix CVE-2007-4528?
To fix CVE-2007-4528, upgrade PHP to a version later than 5.0.5 where this vulnerability has been addressed.
What software is affected by CVE-2007-4528?
CVE-2007-4528 affects PHP version 5.0.5 specifically.
What kind of attacks can exploit CVE-2007-4528?
CVE-2007-4528 can be exploited by attackers to execute arbitrary code through unsafe loading of DLLs.
Is safe_mode effective against CVE-2007-4528?
No, safe_mode restrictions are not effective against CVE-2007-4528, allowing attackers to bypass them.