PT-2012-1228 · Php+4 · Php+4
Neal Poole
·
Publicado
2012-05-08
·
Atualizado
2018-01-18
·
CVE-2012-1172
CVSS v2.0
5.8
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.4.0
Description
The issue arises from insufficient input validation in the file-upload implementation, making it easier for remote attackers to cause a denial of service or conduct directory traversal attacks during multi-file uploads. This can be achieved by leveraging a script that lacks its own filename restrictions, particularly by exploiting the improper handling of invalid
[ (open square bracket) characters in name values.Recommendations
For PHP versions prior to 5.4.0, update to version 5.4.0 or later to resolve the issue.
As a temporary workaround, consider implementing additional filename restrictions in scripts to minimize the risk of exploitation.
Exploit
Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Hp-Ux
Php
Red Hat
Suse