Fluid Attacks Database

Description

The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel6	php	<0:5.3.3-14.el6_3	0:5.3.3-14.el6_3
rpm rhel5	php	<0:5.1.6-39.el5_8	0:5.1.6-39.el5_8
rpm rhel5	php53	<0:5.3.3-13.el5_8	0:5.3.3-13.el5_8

Aliases

1. CVE-2012-11722. NVD-2012-11723. OSV-2012-1172

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.