cve/2007/CVE-2007-3378.md

### [CVE-2007-3378](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3378)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safe_mode and open_basedir restrictions and possibly execute arbitrary commands, as demonstrated using (a) php_value, (b) php_flag, and (c) directives in .htaccess.

### POC

#### Reference
- http://seclists.org/fulldisclosure/2020/Sep/34
- http://securityreason.com/achievement_exploitalert/9
- http://www.openwall.com/lists/oss-security/2020/09/17/3

#### Github
No PoCs found on GitHub currently.