← back
CVE-2007-3799

CVE-2007-3799

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 7.9%
from disclosure to weapon0 days
Published on NVDJul 16
1st PoCJun 4
exploitation probability
7.9%top 6% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the session_start function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207.
Affected products
n/a · n/a
public PoCs found — 1✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/30130
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://docs.info.apple.com/article.html?artnum=307562http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.htmlhttp://osvdb.org/36855http://rhn.redhat.com/errata/RHSA-2007-0889.htmlhttp://secunia.com/advisories/26871http://secunia.com/advisories/26895http://secunia.com/advisories/26930http://secunia.com/advisories/26967http://secunia.com/advisories/27351http://secunia.com/advisories/27377http://secunia.com/advisories/27545http://secunia.com/advisories/27864