CVE-2007-1583 Security feature bypass in n/a
Remote attackers can bypass register_globals security checks in PHP by triggering memory limit violations, allowing execution of scripts with unsafe global variable handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-1583?
CVE-2007-1583 is a medium-severity vulnerability in Php Php, published on 21 Mar 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The mb_parse_str function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal register_globals flag and does not disable it in certain cases when a script terminates, which allows remote attackers to invoke available PHP scripts with register_globals functionality that is not detectable by these scripts, as demonstrated by forcing a memory_limit violation.
Which versions are affected by CVE-2007-1583?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2007-1583?
Upgrade to a fixed version.
Is CVE-2007-1583 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-1583 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-mx7r-xhxh-f687.