Description
The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session variables without considering the internal pointer from the session globals, which allows context-dependent attackers to execute arbitrary code via a crafted string in the session_register after unsetting HTTP_SESSION_VARS and _SESSION, which destroys the session data Hashtable.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | php5 | 5.2.0-10+lenny1 | DTSA-39-1 |
| Debian 4.0 | php5 | 5.2.0-8+etch3 | DSA-1283-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- PHP < 4.4.5/5.2.1 - '_SESSION unset()' Local Overflow EDB-3571 · local · Mar 25, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- DTSA-39-1 php5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1283-1 php5 Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2007-1991 vdb-entry
- 25056 third-party-advisory
- DSA-1283 vendor-advisory
- SSRT071423 vendor-advisory
- GLSA-200705-19 vendor-advisory
- http://www.php-security.org/MOPB/MOPB-30-2007.html
- 23119 vdb-entry
- HPSBTU02232 vendor-advisory
- 25062 third-party-advisory
- ADV-2007-2374 vdb-entry
- 25423 third-party-advisory
- USN-455-1 vendor-advisory
- 25850 third-party-advisory
- 25445 third-party-advisory
- 25057 third-party-advisory
- php-session-extension-code-execution(33520) vdb-entry
- SUSE-SA:2007:032 vendor-advisory