CVE-2007-1369

ini_modifier (sgid-zendtech) in Zend Platform 2.2.3 and earlier allows local users to modify the system php.ini file by editing a copy of php.ini file using the -f parameter, and then performing a symlink attack using the directory that contains the attacker-controlled php.ini file, and linking this directory to /usr/local/Zend/etc.

• http://osvdb.org/33930
• http://secunia.com/advisories/24501
• http://www.osvdb.org/32773
• http://www.php-security.org/MOPB/BONUS-07-2007.htmlVendor Advisory
• http://www.securityfocus.com/bid/22802
• http://www.vupen.com/english/advisories/2007/0829
• http://www.zend.com/products/zend_platform/security_vulnerabilitiesPatch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32820
• http://osvdb.org/33930
• http://secunia.com/advisories/24501
• http://www.osvdb.org/32773
• http://www.php-security.org/MOPB/BONUS-07-2007.htmlVendor Advisory
• http://www.securityfocus.com/bid/22802
• http://www.vupen.com/english/advisories/2007/0829
• http://www.zend.com/products/zend_platform/security_vulnerabilitiesPatch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32820

Published

Mar 9, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-1363Multiple SQL injection vulnerabilities in DropAFew before 0.…
• CVE-2007-1364DropAFew before 0.2.1 does not require authorization for cer…
• CVE-2007-1365Buffer overflow in kern/uipc_mbuf2.c in OpenBSD 3.9 and 4.0 …
• CVE-2007-1366QEMU 0.8.2 allows local users to crash a virtual machine via…
• CVE-2007-1367Cross-site scripting (XSS) vulnerability in the login page i…
• CVE-2007-1368The Project issue tracking module before 4.7.x-1.3, 4.7.x-2.…
• CVE-2007-1370Zend Platform 2.2.3 and earlier has incorrect ownership for …
• CVE-2007-1371Multiple buffer overflows in Conquest 8.2a and earlier (1) a…
• CVE-2007-1372PHP remote file inclusion vulnerability in styles/internal/h…
• CVE-2007-1373Stack-based buffer overflow in Mercury/32 (aka Mercury Mail …
• CVE-2007-1374Cross-site scripting (XSS) vulnerability in pop_profile.asp …
• CVE-2007-1375Integer overflow in the substr_compare function in PHP 5.2.1…