CVE-2007-5447: Medium severity ioncube Php Encoder vulnerability

Published Oct 14, 2007

Updated

ioncubeloaderwin5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safemode and disablefunctions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncubereadfile function.

Affected Software

2 affected components

ioncube Php Encoder=6.5

PHP PHP=5.2.4

Event History

Oct 14, 2007

CVE Published

06:17 PM

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5447?

CVE-2007-5447 has a medium severity rating due to its potential for unauthorized file access.

How do I fix CVE-2007-5447?

To fix CVE-2007-5447, upgrade to a version of the ionCube Loader that properly enforces safe_mode and disable_functions restrictions.

Who is affected by CVE-2007-5447?

CVE-2007-5447 affects users running PHP 5.2.4 with the ionCube Loader 6.5 extension.

What kind of attack does CVE-2007-5447 enable?

CVE-2007-5447 enables context-dependent attackers to read arbitrary files on the server.

Is there a workaround for CVE-2007-5447?

A workaround for CVE-2007-5447 includes disabling the ionCube Loader or restricting its use within an environment that does not rely on safe_mode.