ID:11564 - Exploit for Deserialization of Untrusted Data in PHP - CVE-2007-1701

Link to public exploit:

Vulnerability description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION|s:39:". Successful exploitation requires that variable "register_globals" is enabled.

Remediation