CVE-2005-3390

Published: Nov 1, 2005Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.

Affected (63)

Products: Php: Php

Php

1 product

Php

Configuration A

63 vulnerable

Vulnerable Software	Affected Versions
Php Php	Version 3.0.10
Php Php	Version 3.0.11
Php Php	Version 3.0.12
Php Php	Version 3.0.13
Php Php	Version 3.0.14
Php Php	Version 3.0.15
Php Php	Version 3.0.16
Php Php	Version 3.0.17
Php Php	Version 3.0.18
Php Php	Version 3.0.1
Php Php	Version 3.0.2
Php Php	Version 3.0.3
Php Php	Version 3.0.4
Php Php	Version 3.0.5
Php Php	Version 3.0.6
Php Php	Version 3.0.7
Php Php	Version 3.0.8
Php Php	Version 3.0.9
Php Php	Version 3.0
Php Php	Version 4.0.0
Php Php	Version 4.0.1
Php Php	Version 4.0.1 patch1
Php Php	Version 4.0.1 patch2
Php Php	Version 4.0.2
Php Php	Version 4.0.3
Php Php	Version 4.0.3 patch1
Php Php	Version 4.0.4
Php Php	Version 4.0.5
Php Php	Version 4.0.6
Php Php	Version 4.0.7
Php Php	Version 4.0.7 rc1
Php Php	Version 4.0.7 rc2
Php Php	Version 4.0.7 rc3
Php Php	Version 4.1.0
Php Php	Version 4.1.1
Php Php	Version 4.1.2
Php Php	Version 4.2.0
Php Php	Version 4.2.1
Php Php	Version 4.2.2
Php Php	Version 4.2.3
Php Php	Version 4.2
Php Php	Version 4.3.0
Php Php	Version 4.3.10
Php Php	Version 4.3.11
Php Php	Version 4.3.1
Php Php	Version 4.3.2
Php Php	Version 4.3.3
Php Php	Version 4.3.4
Php Php	Version 4.3.5
Php Php	Version 4.3.6
Php Php	Version 4.3.7
Php Php	Version 4.3.8
Php Php	Version 4.3.9
Php Php	Version 4.4.0
Php Php	Version 5.0.0
Php Php	Version 5.0.1
Php Php	Version 5.0.2
Php Php	Version 5.0.3
Php Php	Version 5.0.4
Php Php	Version 5.0.5
Php Php	Version 5.0 rc1
Php Php	Version 5.0 rc2
Php Php	Version 5.0 rc3

References (66)

http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2006-0549.html

Source: cve@mitre.org

http://secunia.com/advisories/17371

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/17490

Source: cve@mitre.org

http://secunia.com/advisories/17510

Source: cve@mitre.org

http://secunia.com/advisories/17531

Source: cve@mitre.org

http://secunia.com/advisories/17557

Source: cve@mitre.org

http://secunia.com/advisories/17559

Source: cve@mitre.org

http://secunia.com/advisories/18054

Source: cve@mitre.org

http://secunia.com/advisories/18198

Source: cve@mitre.org

http://secunia.com/advisories/18669

Source: cve@mitre.org

http://secunia.com/advisories/21252

Source: cve@mitre.org

http://secunia.com/advisories/22691

Source: cve@mitre.org

http://securityreason.com/securityalert/132

Source: cve@mitre.org

http://securitytracker.com/id?1015129

Source: cve@mitre.org

http://support.avaya.com/elmodocs2/security/ASA-2006-037.htm

Source: cve@mitre.org

http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200511-08.xml

Source: cve@mitre.org

http://www.hardened-php.net/advisory_202005.79.html

Source: cve@mitre.org

Vendor Advisory

http://www.hardened-php.net/globals-problem

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2005:213

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2005_27_sr.html

Source: cve@mitre.org

http://www.openpkg.org/security/OpenPKG-SA-2005.027-php.html

Source: cve@mitre.org

http://www.php.net/release_4_4_1.php

Source: cve@mitre.org

Patch

http://www.redhat.com/support/errata/RHSA-2005-831.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2005-838.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/415290/30/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/419504/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/15250

Source: cve@mitre.org

Patch

http://www.vupen.com/english/advisories/2005/2254

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/4320

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10537

Source: cve@mitre.org

https://www.ubuntu.com/usn/usn-232-1/

Source: cve@mitre.org

http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522