CVE-2011-2202

The rfc1867posthandler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request...

PT-2011-3679

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.7 Description The issue concerns a problem with the rfc1867 post handler function in PHP, which does not properly restrict filenames in multipart/form-data POST requests. This allows remote attackers to conduct absolu...