CVE-2007-3997

Severity

75%

Complexity

99%

Confidentiality

106%

The (1) MySQL and (2) MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safe_mode and open_basedir restrictions via MySQL LOCAL INFILE operations, as demonstrated by a query with LOAD DATA LOCAL INFILE.

The (1) MySQL and (2) MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safe_mode and open_basedir restrictions via MySQL LOCAL INFILE operations, as demonstrated by a query with LOAD DATA LOCAL INFILE.

CVSS 2.0 Base Score 7.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P).

Overview

First reported 17 years ago

2007-09-04 18:17:00

Last updated 6 years ago

2018-10-26 13:59:00

Affected Software

PHP PHP

References

26642

Third Party Advisory

26822

Third Party Advisory

26838

Third Party Advisory

27102

Third Party Advisory

27377

Third Party Advisory

28318

Third Party Advisory

3102

Exploit, Third Party Advisory

http://secweb.se/en/advisories/php-mysql-safe-mode-bypass-vulnerability/

Exploit, Third Party Advisory

GLSA-200710-02

Third Party Advisory

http://www.php.net/ChangeLog-4.php

Vendor Advisory

http://www.php.net/ChangeLog-5.php#5.2.4

Vendor Advisory

http://www.php.net/releases/4_4_8.php

Vendor Advisory

http://www.php.net/releases/5_2_4.php

Vendor Advisory

2007-0026

Broken Link

ADV-2007-3023

Permissions Required, Third Party Advisory

ADV-2008-0059

Permissions Required, Third Party Advisory

php-local-infile-security-bypass(36384)

Third Party Advisory, VDB Entry

php-localinfile-mysql-security-bypass(39402)

Third Party Advisory, VDB Entry

https://issues.rpath.com/browse/RPL-1693

Broken Link

https://issues.rpath.com/browse/RPL-1702

Broken Link

4392

Third Party Advisory, VDB Entry

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.