CVE-2012-0831
Published Feb 10, 2012
Last updated 2 years ago
Overview
- Description
- PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c.
- Source
- secalert@redhat.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 6.8
- Impact score
- 6.4
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-20
Evaluator
- Comment
- -
- Impact
- As per: http://grokbase.com/t/php/php-internals/122ehfap93/about-cve-2012-0831-magic-quotes-gpc-remote-disable-vulnerability Version 5.3.10 and 5.3.11 are also vulnerable.
- Solution
- As per: http://grokbase.com/t/php/php-internals/122ehfap93/about-cve-2012-0831-magic-quotes-gpc-remote-disable-vulnerability Version 5.3.10 and 5.3.11 are also vulnerable.
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "967EAC47-405C-4AA9-AC96-D3D750029AD0",
"versionEndIncluding": "5.3.10"
}
],
"operator": "OR"
}
]
}
]