CVE-2007-1835

PHP <4.4.5 & <5.2.1 - Info Disclosure

Title source: llm

Description

PHP 4 before 4.4.5 and PHP 5 before 5.2.1, when using an empty session save path (session.save_path), uses the TMPDIR default after checking the restrictions, which allows local users to bypass open_basedir restrictions.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Stefan Esser · phplocalphp

https://www.exploit-db.com/exploits/29801

View Code ZIP pw:eip

References (9)

[Vendor Advisory] http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506

[Vendor Advisory] http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/33550

[Various Sources] http://www.php-security.org/MOPB/MOPB-36-2007.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/23183

[Third Party Advisory] http://secunia.com/advisories/25423

[Third Party Advisory] http://secunia.com/advisories/25850

[Third Party Advisory] http://www.vupen.com/english/advisories/2007/1991

[Third Party Advisory] http://www.vupen.com/english/advisories/2007/2374

Scores

EPSS 0.0014

EPSS Percentile 33.4%

Details

Status published

Products (36)

php/php 4.0 (8 CPE variants)

php/php 4.0.0

php/php 4.0.1 (3 CPE variants)

php/php 4.0.2

php/php 4.0.3 (2 CPE variants)

php/php 4.0.4 (2 CPE variants)

php/php 4.0.5

php/php 4.0.6

php/php 4.0.7 (4 CPE variants)

php/php 4.1.0

... and 26 more

Published Apr 03, 2007

Tracked Since Feb 18, 2026