CVE-2012-1172

Published: May 24, 2012Modified: Apr 29, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.

Affected (49)

Products: Php: Php

1 product

Configuration A

49 vulnerable

Vulnerable Software	Affected Versions
Php Php	Up to 5.3.10
Php Php	Version 5.0.0
Php Php	Version 5.0.0 beta1
Php Php	Version 5.0.0 beta2
Php Php	Version 5.0.0 beta3
Php Php	Version 5.0.0 beta4
Php Php	Version 5.0.0 rc1
Php Php	Version 5.0.0 rc2
Php Php	Version 5.0.0 rc3
Php Php	Version 5.0.1
Php Php	Version 5.0.2
Php Php	Version 5.0.3
Php Php	Version 5.0.4
Php Php	Version 5.0.5
Php Php	Version 5.1.0
Php Php	Version 5.1.1
Php Php	Version 5.1.2
Php Php	Version 5.1.3
Php Php	Version 5.1.4
Php Php	Version 5.1.5
Php Php	Version 5.1.6
Php Php	Version 5.2.0
Php Php	Version 5.2.10
Php Php	Version 5.2.11
Php Php	Version 5.2.12
Php Php	Version 5.2.13
Php Php	Version 5.2.14
Php Php	Version 5.2.15
Php Php	Version 5.2.16
Php Php	Version 5.2.17
Php Php	Version 5.2.1
Php Php	Version 5.2.2
Php Php	Version 5.2.3
Php Php	Version 5.2.4
Php Php	Version 5.2.5
Php Php	Version 5.2.6
Php Php	Version 5.2.7
Php Php	Version 5.2.8
Php Php	Version 5.2.9
Php Php	Version 5.3.0
Php Php	Version 5.3.1
Php Php	Version 5.3.2
Php Php	Version 5.3.3
Php Php	Version 5.3.4
Php Php	Version 5.3.5
Php Php	Version 5.3.6
Php Php	Version 5.3.7
Php Php	Version 5.3.8
Php Php	Version 5.3.9

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (40)

http://isisblogs.poly.edu/2011/08/11/php-not-properly-checking-params/

Source: secalert@redhat.com

Exploit

http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080037.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080041.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080070.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=134012830914727&w=2

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2012/03/13/4

Source: secalert@redhat.com

http://support.apple.com/kb/HT5501

Source: secalert@redhat.com

http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/rfc1867.c?r1=321664&r2=321663&pathrev=321664

Source: secalert@redhat.com

Patch

http://svn.php.net/viewvc?view=revision&revision=321664

Source: secalert@redhat.com

http://www.debian.org/security/2012/dsa-2465

Source: secalert@redhat.com

http://www.php.net/ChangeLog-5.php#5.4.0

Source: secalert@redhat.com

https://bugs.php.net/bug.php?id=48597

Source: secalert@redhat.com

Exploit

https://bugs.php.net/bug.php?id=49683

Source: secalert@redhat.com

https://bugs.php.net/bug.php?id=54374

Source: secalert@redhat.com

Exploit

https://bugs.php.net/bug.php?id=55500

Source: secalert@redhat.com

https://nealpoole.com/blog/2011/10/directory-traversal-via-php-multi-file-uploads/

Source: secalert@redhat.com

Exploit

https://students.mimuw.edu.pl/~ai292615/php_multipleupload_overwrite.pdf

Source: secalert@redhat.com

Exploit

http://isisblogs.poly.edu/2011/08/11/php-not-properly-checking-params/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080037.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080041.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080070.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=134012830914727&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2012/03/13/4

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT5501

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/rfc1867.c?r1=321664&r2=321663&pathrev=321664

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://svn.php.net/viewvc?view=revision&revision=321664

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2012/dsa-2465

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.php.net/ChangeLog-5.php#5.4.0

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.php.net/bug.php?id=48597

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://bugs.php.net/bug.php?id=49683

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.php.net/bug.php?id=54374

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://bugs.php.net/bug.php?id=55500

Source: af854a3a-2127-422b-91ae-364da2661108

https://nealpoole.com/blog/2011/10/directory-traversal-via-php-multi-file-uploads/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://students.mimuw.edu.pl/~ai292615/php_multipleupload_overwrite.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.