PHP4 is prone to a code-execution vulnerability due to a design error in a vulnerable extension. For this vulnerability to occur, the non-maintained 'Ovrimos SQL Server Extension' must have been compiled into the targetted PHP implementation. Successful exploits may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploits would likely crash PHP. PHP versions prior to 4.4.5 with a compiled 'Ovrimos SQL Server Extension' are vulnerable to this issue.

• http://www.php-security.org/MOPB/MOPB-13-2007.html
• http://www.php.net
• http://www.securityfocus.com/bid/22833

---

Updated on 2015-03-25