PT-2005-4189 · Php+1 · Php+1
Stefan Esser
·
Publicado
2005-11-01
·
Atualizado
2024-06-15
·
CVE-2005-3390
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions 4.x up to 4.4.0
PHP versions 5.x up to 5.0.5
Description
The issue allows remote attackers to modify the
GLOBALS array and bypass security protections of PHP applications. This is achieved via a multipart/form-data POST request with a "GLOBALS" file upload field when register globals is enabled.Recommendations
For PHP versions 4.x up to 4.4.0, disable the
register globals setting to prevent exploitation.
For PHP versions 5.x up to 5.0.5, disable the register globals setting to prevent exploitation.
As a temporary workaround, consider restricting access to the RFC1867 file upload feature until a patch is available.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Php
Red Hat