CVEvulnerability

CVE-2001-1370

10.0 HIGH Published 2001-07-21 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2001-07-21
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

prepend.php3 in PHPLib before 7.2d, when register_globals is enabled for PHP, allows remote attackers to execute arbitrary scripts via an HTTP request that modifies $_PHPLIB[libdir] to point to malicious code on another server, as seen in Horde 1.2.5 and earlier, IMP before 2.2.6, and other packages that use PHPLib.

Affected configurations

• phplib team phplib 7.2 • phplib team phplib 7.2.1 • phplib team phplib 7.2b • phplib team phplib 7.2c

References