CVE-2007-3997

PHP 4.4.7/5.2.3 - MySQL/MySQLi 'Safe_Mode' Bypass

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The (1) MySQL and (2) MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safe_mode and open_basedir restrictions via MySQL LOCAL INFILE operations, as demonstrated by a query with LOAD DATA LOCAL INFILE.

Las extensiones (1) MySQL y (2) MySQLi en PHP 4 anterior a 4.4.8, y PHP 5 anterior a 5.2.4, permite a atacantes remotos evitar las restricciones safe_mode y open_basedir a través de operaciones MySQL LOCAL INFILE, como se demostró con un consulta con LOAD DATA LOCAL INFILE.

*Credits: N/A

CVSS Scores

NISTv2 7.5

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-07-25 CVE Reserved
2007-09-04 CVE Published
2024-08-07 CVE Updated
2024-08-07 First Exploit
2024-09-22 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (19)

URL	Tag	Source
http://secunia.com/advisories/26642	Third Party Advisory
http://secunia.com/advisories/26822	Third Party Advisory
http://secunia.com/advisories/26838	Third Party Advisory
http://secunia.com/advisories/27102	Third Party Advisory
http://secunia.com/advisories/27377	Third Party Advisory
http://secunia.com/advisories/28318	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/36384	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/39402	Third Party Advisory
https://issues.rpath.com/browse/RPL-1693	Broken Link
https://issues.rpath.com/browse/RPL-1702	Broken Link

URL	Date	SRC
https://www.exploit-db.com/exploits/4392	2024-08-07
http://securityreason.com/securityalert/3102	2024-08-07
http://secweb.se/en/advisories/php-mysql-safe-mode-bypass-vulnerability	2024-08-07

URL	Date	SRC

URL	Date	SRC
http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml	2018-10-26
http://www.php.net/ChangeLog-4.php	2018-10-26
http://www.php.net/ChangeLog-5.php#5.2.4	2018-10-26
http://www.php.net/releases/4_4_8.php	2018-10-26
http://www.php.net/releases/5_2_4.php	2018-10-26
http://www.trustix.org/errata/2007/0026	2018-10-26

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				>= 4.0.0 < 4.4.8 Search vendor "Php" for product "Php" and version " >= 4.0.0 < 4.4.8"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				>= 5.0.0 < 5.2.4 Search vendor "Php" for product "Php" and version " >= 5.0.0 < 5.2.4"		-		Affected