CVE-2007-1522: php
Vulnerability summary
CVE-2007-1522 is a medium (CVSS 6.8) vulnerability in php. EPSS estimates a 6.71% chance of exploitation in the next 30 days, higher than 93.9% of scored vulnerabilities. 2 public exploits are recorded.
Weaponized exploit (exploit-database, 14-03-2007)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 20-03-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Double free vulnerability in the session extension in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to execute arbitrary code via illegal characters in a session identifier, which is rejected by an internal session storage module, which calls the session identifier generator with an improper environment, leading to code execution when the generator is interrupted, as demonstrated by triggering a memory limit violation or certain PHP errors.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
6.71%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
Increase +0.09 pp
From 6.61% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (php-security.org)
Maturity: unknown
PHP 5.2.0/5.2.1 - Rejected Session ID Double-Free
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Php1 product
- phpEOL5.2.0 | 5.2.1
1 vendor · 1 product