CVE-2016-7125 Deserialization in n/a
Remote attackers can inject arbitrary session data via crafted session names, potentially leading to code execution in PHP applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7125?
CVE-2016-7125 is a high-severity unsafe deserialization vulnerability in Php Php, published on 12 Sep 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection.
Weakness: CWE-74
Which versions are affected by CVE-2016-7125?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2016-7125?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2016-7125 being exploited?
There is no known exploitation of CVE-2016-7125 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-r949-99vg-366c, UBUNTU-CVE-2016-7125.