CVE-2007-1583

PHP 4.0.0-4.4.6 & 5.0.0-5.2.1 - Code Injection

Title source: llm

Description

The mb_parse_str function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal register_globals flag and does not disable it in certain cases when a script terminates, which allows remote attackers to invoke available PHP scripts with register_globals functionality that is not detectable by these scripts, as demonstrated by forcing a memory_limit violation.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Stefan Esser · phpremotephp
https://www.exploit-db.com/exploits/29752

References (30)

... and 10 more

Scores

EPSS 0.2356
EPSS Percentile 96.0%

Details

Status published
Products (36)
php/php 4.0 (8 CPE variants)
php/php 4.0.0
php/php 4.0.1 (3 CPE variants)
php/php 4.0.2
php/php 4.0.3 (2 CPE variants)
php/php 4.0.4 (2 CPE variants)
php/php 4.0.5
php/php 4.0.6
php/php 4.0.7 (4 CPE variants)
php/php 4.1.0
... and 26 more
Published Mar 21, 2007
Tracked Since Feb 18, 2026