Unscored severity · published Mar 9, 2007
CVE-2007-1369
ini_modifier (sgid-zendtech) in Zend Platform 2.2.3 and earlier allows local users to modify the system php.ini file by editing a copy of php.ini file using the -f parameter, and…
–
CVSS
0.7%
EPSS
No
On KEV
Description
ini_modifier (sgid-zendtech) in Zend Platform 2.2.3 and earlier allows local users to modify the system php.ini file by editing a copy of php.ini file using the -f parameter, and then performing a symlink attack using the directory that contains the attacker-controlled php.ini file, and linking this directory to /usr/local/Zend/etc.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZP
Zend Platform · Zend
through 2.2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1369
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1369
osvdb.org
http://osvdb.org/33930
secunia.com
http://secunia.com/advisories/24501
www.osvdb.org
http://www.osvdb.org/32773
Vendor Advisory
http://www.php-security.org/MOPB/BONUS-07-2007.html
www.securityfocus.com
http://www.securityfocus.com/bid/22802
www.vupen.com
http://www.vupen.com/english/advisories/2007/0829
More from Zend Platform
–
CVE-2007-1370
Zend Platform 2.2.3 and earlier has incorrect ownership for scd.sh and certain other files, which allows local users to gain root privileges by modifying the files
–
CVE-2006-4431
Multiple buffer overflows in the (a) Session Clustering Daemon and the (b) mod_cluster module in the Zend Platform 2.2.1 and earlier allow remote attackers to cause a denial of…
–
CVE-2006-4432
Directory traversal vulnerability in Zend Platform 2.2.1 and earlier allows remote attackers to overwrite arbitrary files via a