CVE-2007-1711

PHP 4.4.5-4.4.6 - Use-After-Free in Unserializer

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-1711. PoCs published by Stefan Esser.

AI-analyzed exploit summary This exploit targets a double-free vulnerability in PHP's session_decode() function (CVE-2007-1711) by manipulating session variables to trigger memory corruption. It demonstrates arbitrary memory manipulation via destructor pointer overwriting.

Description

Double free vulnerability in the unserializer in PHP 4.4.5 and 4.4.6 allows context-dependent attackers to execute arbitrary code by overwriting variables pointing to (1) the GLOBALS array or (2) the session data in _SESSION. NOTE: this issue was introduced when attempting to patch CVE-2007-1701 (MOPB-31-2007).

Exploits (1)

exploitdb WORKING POC VERIFIED
by Stefan Esser · phpdoslinux
https://www.exploit-db.com/exploits/3586

This exploit targets a double-free vulnerability in PHP's session_decode() function (CVE-2007-1711) by manipulating session variables to trigger memory corruption. It demonstrates arbitrary memory manipulation via destructor pointer overwriting.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: PHP 4.4.5/4.4.6
No auth needed
Prerequisites: PHP with vulnerable session handling enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (26)

Core 26
Core References
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/2732
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/23121
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2007/dsa-1283
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2007-0154.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/466166/100/0/threaded
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200705-19.xml
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/24941
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25062
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10406
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2007:087
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/24945
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2007/dsa-1282
Issue Tracking x_refsource_confirm
https://issues.rpath.com/browse/RPL-1268
Vendor Advisory x_refsource_confirm
http://docs.info.apple.com/article.html?artnum=306172
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/33575
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/24924
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2007-0155.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/24910
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/25159
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25445
Various Sources x_refsource_misc
http://www.php-security.org/MOPB/MOPB-32-2007.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2007-0163.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25025
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2007:088
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26235

Scores

EPSS 0.0762
EPSS Percentile 93.8%

Details

Status published
Products (2)
php/php 4.4.5
php/php 4.4.6
Published Mar 27, 2007
Tracked Since Feb 18, 2026