medium6.8Public exploit code
CVE-2007-1382
The PHP COM extensions for PHP on Windows systems allow context-dependent attackers to execute arbitrary code via a WScript.Shell COM object, as demonstrated b…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHP 'COM' Extensions - inconsistent Win32 'safe_mode' Bypass2007-03-07 · local · windows · Verified
Impact
The PHP COM extensions for PHP on Windows systems allow context-dependent attackers to execute arbitrary code via a WScript.Shell COM object, as demonstrated by using the Run method of this object to execute cmd.exe, which bypasses PHP's safe mode.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Php | Com Extensions | All versions |