CVE-2007-3799
PHP 4.x-4.4.7 and 5.x-5.2.3 - Session Cookie Attribute Injection via Special Characters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2007-3799. PoCs published by Stefan Esser.
AI-analyzed exploit summary This is a writeup describing an HTTP-response-header-injection vulnerability in PHP versions 5.2.3 and prior, and PHP 4.4.7 and prior. It explains how an attacker can inject additional cookie attributes into session cookies by manipulating the URL.
Description
The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the session_start function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207.
Exploits (1)
This is a writeup describing an HTTP-response-header-injection vulnerability in PHP versions 5.2.3 and prior, and PHP 4.4.7 and prior. It explains how an attacker can inject additional cookie attributes into session cookies by manipulating the URL.