CVE-2007-4528

The Foreign Function Interface (ffi) extension in PHP 5.0.5 does not follow safe_mode restrictions, which allows context-dependent attackers to execute…

published August 25, 2007

CVSS
—
EPSS
5%
Percentile
92.0
In the wild
Unconfirmed
What it is

The Foreign Function Interface (ffi) extension in PHP 5.0.5 does not follow safe_mode restrictions, which allows context-dependent attackers to execute arbitrary code by loading an arbitrary DLL and calling a function, as demonstrated by kernel32.dll and the WinExec function. NOTE: this issue does not cross privilege boundaries in most contexts, so perhaps it should not be included in CVE.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04840 · 92.0th percentile
Published
2007-08-25T00:00Z
EPSS history
Timeline
  • 25 AUG 00:00Z
    The Foreign Function Interface (ffi) extension in PHP 5.0.5 does not follow safe_mode restrictions, which allows context-dependent attackers to execute…
    cvelistv5