CVE-2007-2509

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-05-09 · updated 2026-06-16
Weakness: CWE-20

Description

CRLF injection vulnerability in the ftp_putcmd function in PHP before 4.4.7, and 5.x before 5.2.2 allows remote attackers to inject arbitrary FTP commands via CRLF sequences in the parameters to earlier FTP commands.

Affected products

PHP: 4.0.0, 4.0.1, 4.0.1-patch1, 4.0.1-patch2, 4.0.2, 4.0.3 (+53)

References

http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html
http://rhn.redhat.com/errata/RHSA-2007-0889.html
http://secunia.com/advisories/25187
http://secunia.com/advisories/25191
http://secunia.com/advisories/25255
http://secunia.com/advisories/25318
http://secunia.com/advisories/25365
http://secunia.com/advisories/25372
http://secunia.com/advisories/25445
http://secunia.com/advisories/25660
http://secunia.com/advisories/26048
http://secunia.com/advisories/26967

Get alerted when CVE-2007-2509 or the next vulnerability affects your stack