Skip to content
Fencer Vulns
medium 4.3

CVE-2003-1307 json

The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process g…

published 2003-12-31 22 y ago modified 2026-06-16 4 mo ago also EUVD-2003-1297

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
2
Exploit-DB

Summary

The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.

Timeline

  1. First public exploit (EDB-23482)
  2. Published

Exploit prediction

1.72% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-23482 Apache 2.0.4x mod_php - File Descriptor Leakage (2) local, 2003-12-26
  • EDB-23481 Apache 2.0.4x mod_php - File Descriptor Leakage (1) local, 2003-12-26
  • bugs.php.net http://bugs.php.net/38915 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/archive/1/348368 referenced PoC, tagged "exploit" by a source, unverified
  • hackerdom.ru http://hackerdom.ru/~dimmo/phpexpl.c referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/bid/9302 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.