CVE-2007-5447

Summary

ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncube_read_file function.

Impact & exploitability

AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected products we track (1)

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

• NVD record
• http://secunia.com/advisories/27178Advisory
• http://osvdb.org/41708
• http://www.securityfocus.com/bid/26024
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37227
• https://www.exploit-db.com/exploits/4517