CVE-2007-1396
- State
- Published
- Severity
- Not scored
- Published
- Mar 10, 2007
- Updated
- Aug 7, 2024
- Reserved
- Mar 10, 2007
Description
The import_request_variables function in PHP 4.0.7 through 4.4.6, and 5.x before 5.2.2, when called without a prefix, does not prevent the (1) GET, (2) POST, (3) COOKIE, (4) FILES, (5) SERVER, (6) SESSION, and other superglobals from being overwritten, which allows remote attackers to spoof source IP address and Referer data, and have other unspecified impact. NOTE: it could be argued that this is a design limitation of PHP and that only the misuse of this feature, i.e. implementation bugs in applications, should be included in CVE. However, it has been fixed by the vendor.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20070308 PHP import_request_variables() arbitrary variable overwritemailing-list
- 20070314 Re: Re: [Full-disclosure] PHP import_request_variables() arbitrary variable overwritemailing-list
- 26048third-party-advisory
- 22886vdb-entry
- http://us2.php.net/releases/4_4_7.php
- 2406third-party-advisory
- 20070310 Re: [Full-disclosure] PHP import_request_variables() arbitrary variable overwritemailing-list
- 20070312 Re: [Full-disclosure] PHP import_request_variables() arbitrary variable overwritemailing-list
- http://us2.php.net/releases/5_2_2.php
- SUSE-SA:2007:044vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.