PT-2012-2893 · Php+3 · Php+3
CVE-2012-0831
·
Publicado
2012-02-10
·
Atualizado
2022-08-16
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.3.10
Description
The issue makes it easier for remote attackers to conduct SQL injection attacks via a crafted request. This is related to the improper handling of the magic quotes gpc directive during the importing of environment variables.
Recommendations
For PHP versions prior to 5.3.10, update to version 5.3.10 or later to resolve the issue. As a temporary workaround, consider disabling the use of environment variables in scripts until a patch is available. Restrict access to sensitive database operations to minimize the risk of exploitation. Avoid using user-supplied input in SQL queries until the issue is resolved.
Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Php
Red Hat
Suse