CVE-2007-1701: php Deserialization of Untrusted Data
Vulnerability summary
CVE-2007-1701 is a medium (CVSS 6.8) Deserialization of Untrusted Data vulnerability in php. EPSS estimates a 9.36% chance of exploitation in the next 30 days, higher than 95.4% of scored vulnerabilities. 1 public exploit is recorded.
Weaponized exploit (exploit-database, 25-03-2007)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5Timeline
- 27-03-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION|s:39:".
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
9.36%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
Increase +0.13 pp
From 9.23% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundPHP < 4.4.5/5.2.1 - '_SESSION' Deserialization Overwrite
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Php1 product
- php≥ 4.0.0, < 4.4.5 | ≥ 5.0.0, < 5.2.1
1 vendor · 1 product
References
12 links- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11034VDB EntrySignatureX Refsource OVALThird Party Advisory
- h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506Vendor AdvisoryX Refsource HPBroken Link
- h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137Vendor AdvisoryX Refsource HPBroken Link