Description

The win32std extension in PHP 5.2.3 does not follow safe_mode and disable_functions restrictions, which allows remote attackers to execute arbitrary commands via the win_shell_execute function.

Remediation

References

CVE-2007-4010

Related Vulnerabilities

Squid Missing Release of Resource after Effective Lifetime Vulnerability (CVE-2018-19132)

WordPress 4.7.x PHP Object Injection (4.7 - 4.7.20)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-25815)

WordPress Plugin Fast Secure Contact Form 'index.php' Cross-Site Scripting (3.0.3.1)

Drupal Core 7.x Multiple Vulnerabilities (7.0 - 7.33)

Severity

Medium

Classification

CVE-2007-4010

Tags

Missing Update Known Vulnerabilities