PT-2011-1654 · Php+1 · Php+1

Publicado

2011-01-18

·

Atualizado

2017-09-19

·

CVE-2010-4700

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions PHP versions 5.3.2 through 5.3.3
Description The issue arises from the interaction between the set magic quotes runtime function and the mysqli fetch assoc function when the MySQLi extension is used. This might facilitate context-dependent attackers to conduct SQL injection attacks via crafted input that was properly handled in earlier PHP versions.
Recommendations For PHP versions 5.3.2 and 5.3.3, consider disabling the use of the set magic quotes runtime function when using the MySQLi extension as a temporary workaround until a patch is available. Restrict access to user input that is handled by the mysqli fetch assoc function to minimize the risk of exploitation.

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2010-4700

Produtos afetados

Mysqli
Php