VULNERABILITY INTELLIGENCE

CVE-2008-7068

CVSS score6.4 MEDIUM
EPSS probability1.59%
CISA KEVNot currently listed
Published2009-08-25
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:N/I:P/A:P

Description

The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references