CVE-2004-1020
The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applicatio…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHP 4/5 - 'addslashes()' Null Byte Bypass2004-12-16 · remote · php · Verified
Impact
The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magic_quotes_gpc mechanism. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Php | Php | Versions 4.3.6, 4.3.7, 4.3.8, 4.3.9, 5.0, 5.0.0 |
References
- NVD record
- CVE.org record
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915
- http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:151
- http://www.php.net/release_4_3_10.php
- http://www.securityfocus.com/advisories/9028
- http://www.securityfocus.com/archive/1/384663
- http://www.securityfocus.com/bid/11981
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18516
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915
- http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:151
- http://www.php.net/release_4_3_10.php
- http://www.securityfocus.com/advisories/9028
- http://www.securityfocus.com/archive/1/384663
- http://www.securityfocus.com/bid/11981
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18516