CVE-2007-5447 ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended l...
MediumCVSS 4.3
EPSS 4.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncube_read_file function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ioncube php encoder | = 6.5 | No fix listed |
| PHP | = 5.2.4 | No fix listed |
References
- 41708 vdb-entry
- 27178 third-party-advisory vendor-advisory
- 26024 vdb-entry
- ioncube-readfile-security-bypass(37227) vdb-entry
- 4517 exploit