CVE-2007-1701: PHP

Medium severity, CVSS 6.8. EPSS: 9.2% chance of exploitation in the next 30 days.

PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION|s:39:".

Affected products

• PHP PHP: from 4.0.0, before 4.4.5 (fixed in 4.4.5); from 5.0.0, before 5.2.1 (fixed in 5.2.1)

Published 2007-03-27. Last modified 2026-06-16.