Skip to content
Fencer Intel
medium 4.3

CVE-2003-1307 json

The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process g…

published 22y ago modified 4mo ago also EUVD-2003-1297

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
2
Exploit-DB

Summary

The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.

Is CVE-2003-1307 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

  1. First public exploit (EDB-23482)
  2. Published

Exploit prediction

1.72% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-14).

Exploits and checks

  • EDB-23482 Apache 2.0.4x mod_php - File Descriptor Leakage (2) local, 2003-12-26
  • EDB-23481 Apache 2.0.4x mod_php - File Descriptor Leakage (1) local, 2003-12-26
  • bugs.php.net http://bugs.php.net/38915 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/archive/1/348368 referenced PoC, tagged "exploit" by a source, unverified
  • hackerdom.ru http://hackerdom.ru/~dimmo/phpexpl.c referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/bid/9302 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P

Classification

Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.