CVE-2008-5624: php
Vulnerability summary
CVE-2008-5624 is a high (CVSS 7.5) vulnerability in php. EPSS estimates a 2.22% chance of exploitation in the next 30 days, higher than 82.7% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2Timeline
- 17-12-2008PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-dependent attackers to bypass safe_mode restrictions via variable settings that are intended to be restricted to root, as demonstrated by a setting of /etc for the error_log variable.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.22%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.22% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (securityreason.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Php1 product
- phpEOL5.0.0 | 5.0.0:beta1 | 5.0.0:beta2 | 5.0.0:beta3 | 5.0.0:beta4 | 5.0.0:rc1 | 5.0.0:rc2 | 5.0.0:rc3 | 5.0.1 | 5.0.2 | 5.0.3 | 5.0.4 | 5.0.5 | 5.1.0 | 5.1.1 | 5.1.2 | 5.1.3 | 5.1.4 | 5.1.5 | 5.1.6 | 5.2.0 | 5.2.1 | 5.2.2 | 5.2.3 | 5.2.4 | 5.2.5 | 5.2.6 | 5.2.7
1 vendor · 1 product
References
15 links- wiki.rpath.com/Advisories:rPSA-2009-0035X Refsource CONFIRM
- www.php.net/ChangeLog-5.phpX Refsource CONFIRM
