PT-2011-1654 · Php+1 · Php+1

Published 2011-01-18 · Updated 2017-09-19 · CVE-2010-4700

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 5.3.2 through 5.3.3

Description The issue arises from the interaction between the set magic quotes runtime function and the mysqli fetch assoc function when the MySQLi extension is used. This might facilitate context-dependent attackers to conduct SQL injection attacks via crafted input that was properly handled in earlier PHP versions.

Recommendations For PHP versions 5.3.2 and 5.3.3, consider disabling the use of the set magic quotes runtime function when using the MySQLi extension as a temporary workaround until a patch is available. Restrict access to user input that is handled by the mysqli fetch assoc function to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-4700

Affected Products

Mysqli

Php

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2010-4700 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12620 · Note
• http://bugs.php.net/52221 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64964 · Note
• http://securityfocus.com/bid/46056 · Note
• http://php.net/ChangeLog-5.php · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4700 · Note