CVE-2007-1701

PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION|s:39:".

• CWE-502

• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506Broken Link
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137Broken Link
• http://secunia.com/advisories/25423Third Party Advisory
• http://secunia.com/advisories/25445Third Party Advisory
• http://secunia.com/advisories/25850Third Party Advisory
• http://security.gentoo.org/glsa/glsa-200705-19.xmlThird Party Advisory
• http://www.php-security.org/MOPB/MOPB-31-2007.htmlThird Party Advisory
• http://www.securityfocus.com/bid/23120Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2007/1991Third Party Advisory
• http://www.vupen.com/english/advisories/2007/2374Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33658Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11034Third Party Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506Broken Link
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137Broken Link
• http://secunia.com/advisories/25423Third Party Advisory
• http://secunia.com/advisories/25445Third Party Advisory
• http://secunia.com/advisories/25850Third Party Advisory
• http://security.gentoo.org/glsa/glsa-200705-19.xmlThird Party Advisory
• http://www.php-security.org/MOPB/MOPB-31-2007.htmlThird Party Advisory
• http://www.securityfocus.com/bid/23120Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2007/1991Third Party Advisory
• http://www.vupen.com/english/advisories/2007/2374Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33658Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11034Third Party Advisory

Published

Mar 27, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-1695PHP remote file inclusion vulnerability in includes/usercp_r…
• CVE-2007-1696SQL injection vulnerability in ViewNewspapers.asp in Active …
• CVE-2007-1697PHP remote file inclusion vulnerability in header.inc.php in…
• CVE-2007-1698download.php in Philex 0.2.3 and earlier allows remote attac…
• CVE-2007-1699Multiple PHP remote file inclusion vulnerabilities in the SW…
• CVE-2007-1700The session extension in PHP 4 before 4.4.5, and PHP 5 befor…
• CVE-2007-1702PHP remote file inclusion vulnerability in mod_flatmenu.php …
• CVE-2007-1703SQL injection vulnerability in index.php in the RWCards (com…
• CVE-2007-1704SQL injection vulnerability in index.php in the Car Manager …
• CVE-2007-1705SQL injection vulnerability in default.asp in Active Trade 2…
• CVE-2007-1706SQL injection vulnerability in eWebQuiz.asp in eWebQuiz 8 al…
• CVE-2007-1707PHP remote file inclusion vulnerability in index.php in Net …