{"vulnerability": "cve-2007-1286", "sightings": [{"uuid": "7eccbaa2-28e2-4071-a7e4-aa286acdc343", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2007-1286", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:38.000000Z"}, {"uuid": "89d44dc5-644e-43d8-a8fc-902ebe2779e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2007-1286", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:08:21.000000Z"}, {"uuid": "5bc20956-ff66-49a4-b9d1-ad81f23ff44b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2007-1286", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/php/php_unserialize_zval_cookie.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "49230a4b-46ea-4b5f-ac3e-824139fc918d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2007-1286", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/16310", "content": "", "creation_timestamp": "2010-09-20T00:00:00.000000Z"}, {"uuid": "0b76a3f4-2d24-48b7-85e0-1a77687c9fa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2007-1286", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/php/php_unserialize_zval_cookie.rb", "content": "{\"aliases\": [], \"arch\": \"x86\", \"author\": [\"hdm \", \"GML \", \"Stefan Esser \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an integer overflow vulnerability in the unserialize()\\n          function of the PHP web server extension. This vulnerability was patched by\\n          Stefan in version 4.5.0 and applies all previous versions supporting this function.\\n          This particular module targets numerous web applications and is based on the proof\\n          of concept provided by Stefan Esser. This vulnerability requires approximately 900k\\n          of data to trigger due the multiple Cookie headers requirement. Since we\\n          are already assuming a fast network connection, we use a 2Mb block of shellcode for\\n          the brute force, allowing quick exploitation for those with fast networks.\\n\\n          One of the neat things about this vulnerability is that on x86 systems, the EDI register points\\n          into the beginning of the hashtable string. This can be used with an egghunter to\\n          quickly exploit systems where the location of a valid \\\"jmp EDI\\\" or \\\"call EDI\\\" instruction\\n          is known. The EDI method is faster, but the bandwidth-intensive brute force used by this\\n          module is more reliable across a wider range of systems.\", \"disclosure_date\": \"2007-03-04\", \"fullname\": \"exploit/multi/php/php_unserialize_zval_cookie\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:09 +0000\", \"name\": \"PHP 4 unserialize() ZVAL Reference Counter Overflow (Cookie)\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/php/php_unserialize_zval_cookie.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 200, \"ref_name\": \"multi/php/php_unserialize_zval_cookie\", \"references\": [\"CVE-2007-1286\", \"OSVDB-32771\", \"URL-http://web.archive.org/web/20240619200429/http://php-security.org/MOPB/MOPB-04-2007.html\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic\", \"Linux x86 Generic\", \"Linux x86 phpBB2\", \"Linux x86 punBB\", \"Linux x86 WWWThreads\", \"Linux x86 Deadman Redirect\", \"Linux x86 PhpWebGallery\", \"Linux x86 Ariadne-CMS\", \"Linux x86 ProMA\", \"Linux x86 eGroupware\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:27.921193Z"}]}