Description

PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION|s:39:".

Remediation

References

CVE-2007-1701

Related Vulnerabilities

WordPress Plugin Poll, Survey, Form & Quiz Maker by OpinionStage Unspecified Vulnerability (15.0.0)

YUI Library Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-4207)

WordPress Plugin Resume Submissions & Job Postings Cross-Site Scripting (2.5.3)

WordPress Plugin Radio Buttons for Taxonomies Cross-Site Request Forgery (2.0.5)

WordPress Plugin Media File Renamer-Auto & Manual Rename Cross-Site Scripting (1.7.0)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-502 CVE-2007-1701