PT-2016-1111 · Php · Php

Dimitri Fourny · Published 2016-01-19 · Updated 2022-08-05 · CVE-2015-6527

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 7.0.0

Description The issue is related to errors in the code of the php str replace in subject function in the PHP interpreter. It allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str ireplace function. Exploitation of this issue may enable a remote attacker to execute arbitrary code by inputting special parameters.

Recommendations For PHP versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the str ireplace function until a patch is available. Avoid using crafted values in the third argument to the str ireplace function to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2016-00305

CVE-2015-6527

Affected Products

Php

References · 7

• 🔥 https://bugs.php.net/bug.php?id=70140 · Exploit
• https://bdu.fstec.ru/vul/2016-00305 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6527 · Security Note
• http://git.php.net/?p=php-src.git;a=commit;h=6aeee47b2cd47915ccfa3b41433a3f57aea24dd5 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6527 · Note
• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=6aeee47b2cd47915ccfa3b41433a3f57aea24dd5 · Note
• http://openwall.com/lists/oss-security/2015/07/30/11 · Note