CVE-2007-1369 — ini_modifier (sgid-zendtech) in Zend Platform 2.2.3 and earlier allows local users to modify the system php.ini file by editing a copy of php.ini file using the -f parameter, and then performing a symlink attack using the directory that contains the attacker-controlled php.ini file, and linking this directory to /usr/local/Zend/etc

Back Back to CVE browser

MEDIUM

ini_modifier (sgid-zendtech) in Zend Platform 2.2.3 and earlier allows local users to modify the system php.ini file by editing a copy of php.ini file using the -f parameter, and then performing a symlink attack using the directory that contains the attacker-controlled php.ini file, and linking this directory to /usr/local/Zend/etc

Published Mar 9, 2007

4.4

MEDIUM

CVSS 2.0

EPSS 0.64%

Description

ini_modifier (sgid-zendtech) in Zend Platform 2.2.3 and earlier allows local users to modify the system php.ini file by editing a copy of php.ini file using the -f parameter, and then performing a symlink attack using the directory that contains the attacker-controlled php.ini file, and linking this directory to /usr/local/Zend/etc.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.64% 0.00644

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00644

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (8 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.64% (0.00644)	48.97th	v5 (v2026.06.15)
Jun 15, 2026	0.64% (0.00644)	45.84th	v5 (v2026.06.15)
Mar 17, 2025	0.31% (0.00313)	52.25th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00042)	0.34th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00042)	0.50th	v3 (v2023.03.01)
Mar 6, 2023	2.05% (0.02046)	79.42th	v2 (v2022.01.01)
Apr 1, 2022	2.05% (0.02046)	77.59th	v2 (v2022.01.01)
Feb 4, 2022	2.05% (0.02046)	56.47th	v2 (v2022.01.01)

Weaknesses (0)

No CWE recorded.

References (8)

http://osvdb.org/33930
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/24501
third-party-advisoryx_refsource_SECUNIA
http://www.osvdb.org/32773
vdb-entryx_refsource_OSVDB
http://www.php-security.org/MOPB/BONUS-07-2007.html
x_refsource_MISCVendor Advisory
http://www.securityfocus.com/bid/22802
vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2007/0829
vdb-entryx_refsource_VUPEN
http://www.zend.com/products/zend_platform/security_vulnerabilities
x_refsource_CONFIRMPatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/32820
vdb-entryx_refsource_XF

Link	Providers	Tags
http://osvdb.org/33930		vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/24501		third-party-advisoryx_refsource_SECUNIA
http://www.osvdb.org/32773		vdb-entryx_refsource_OSVDB
http://www.php-security.org/MOPB/BONUS-07-2007.html		x_refsource_MISCVendor Advisory
http://www.securityfocus.com/bid/22802		vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2007/0829		vdb-entryx_refsource_VUPEN
http://www.zend.com/products/zend_platform/security_vulnerabilities		x_refsource_CONFIRMPatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/32820		vdb-entryx_refsource_XF

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Mar 9, 2007

Updated Aug 7, 2024

Reserved Mar 9, 2007

Link CVE-2007-1369

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2007-1369

Red Hat

Severity n/a

Public date n/a

Links CVE-2007-1369