PT-2007-2790 · Php · Php
Published
2007-03-10
·
Updated
2018-10-30
·
CVE-2007-1396
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions 4.0.7 through 4.4.6
PHP versions 5.x before 5.2.2
Description
The import request variables function, when called without a prefix, does not prevent the
GET, POST, COOKIE, FILES, SERVER, SESSION, and other superglobals from being overwritten. This allows remote attackers to spoof source IP address and Referer data, and have other unspecified impact.Recommendations
For PHP versions 4.0.7 through 4.4.6, update to a version later than 4.4.6 or apply a patch that fixes the import request variables function.
For PHP versions 5.x before 5.2.2, update to version 5.2.2 or later to resolve the issue.
As a temporary workaround, consider using a prefix when calling the import request variables function to prevent superglobals from being overwritten.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Php