PT-2012-1228 · Php+4 · Php+4

Neal Poole · Published 2012-05-08 · Updated 2018-01-18 · CVE-2012-1172

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.0

Description The issue arises from insufficient input validation in the file-upload implementation, making it easier for remote attackers to cause a denial of service or conduct directory traversal attacks during multi-file uploads. This can be achieved by leveraging a script that lacks its own filename restrictions, particularly by exploiting the improper handling of invalid [ (open square bracket) characters in name values.

Recommendations For PHP versions prior to 5.4.0, update to version 5.4.0 or later to resolve the issue. As a temporary workaround, consider implementing additional filename restrictions in scripts to minimize the risk of exploitation.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-02630

CESA-2012_1046

CVE-2012-1172

DSA-2465-1

HPSBUX02791

RHSA-2012:1045

RHSA-2012:1046

RHSA-2012:1047

RHSA-2012_1045

RHSA-2012_1046

RHSA-2012_1047

SUSE-SU-2012_0598-1

SUSE-SU-2012_0598-2

SUSE-SU-2012_0604-1

Affected Products

Centos

Hp-Ux

Php

Red Hat

Suse

References · 99

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/php_cgi_arg_injection.rb · Exploit
• 🔥 https://github.com/0xl0k1/CVE-2012-1823 · Exploit
• 🔥 https://github.com/Unix13/metasploitable2 · Exploit
• 🔥 https://nealpoole.com/blog/2011/10/directory-traversal-via-php-multi-file-uploads · Exploit
• 🔥❌ https://github.com/Fatalitysec/CVE-2012-1823 · Exploit, Deleted
• 🔥 http://isisblogs.poly.edu/2011/08/11/php-not-properly-checking-params · Exploit
• 🔥 https://bugs.php.net/bug.php?id=48597 · Exploit
• 🔥 https://students.mimuw.edu.pl/~ai292615/php_multipleupload_overwrite.pdf · Exploit
• 🔥❌ https://github.com/theykillmeslowly/CVE-2012-1823 · Exploit, Deleted
• 🔥 https://bugs.php.net/bug.php?id=54374 · Exploit
• https://bdu.fstec.ru/vul/2022-02623 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4153 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2143 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2336 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080041.html · Vendor Advisory