CVE-2007-5447

MediumPublished

ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_functions restrictions, which allows...

Published: Oct 14, 2007
Updated: Aug 7, 2024
Assigning CNA: mitre
Evidence observed: Oct 11, 2007

Primary CVSS

4.3/ 10Medium

nvd · CVSS 2.0

AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS probability estimate

4.6%

Low · next 30 days

Percentile: 91.5%
Model date: Oct 15, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncube_read_file function.

Sources

PHP 5.2.4 ionCube - 'ioncube_read_file' Safe Mode / disable_functions BypassExploit
shinnai · windows · Oct 11, 2007

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.