Description
PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION|s:39:".
Remediation
References
Related Vulnerabilities
Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-6417)
Drupal Core 9.1.x Cross-Site Scripting (9.1.0 - 9.1.8)
WordPress Plugin Image Slider Arbitrary File Deletion (1.1.89)
Liferay Portal Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2023-35030)
WordPress Plugin Spotlight Social Feeds [Block, Shortcode, and Widget] Cross-Site Scripting (1.4.2)