PT-2011-3679 · Php+2 · Php+2
Publicado
2011-06-16
·
Atualizado
2024-06-15
·
CVE-2011-2202
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.3.7
Description
The issue concerns a problem with the
rfc1867 post handler function in PHP, which does not properly restrict filenames in multipart/form-data POST requests. This allows remote attackers to conduct absolute path traversal attacks and possibly create or overwrite arbitrary files through a crafted upload request. The issue is related to a "file path injection vulnerability."Recommendations
For PHP versions prior to 5.3.7, update to version 5.3.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the
rfc1867 post handler function in main/rfc1867.c to minimize the risk of exploitation. Avoid using the vulnerable function until a patch is available.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Php
Red Hat
Suse