CVE-2008-7068

2009-08-2510:30:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2008-7068

php

dba_replace

denial of service

file truncation

vulnerability

nvd

6.2 Medium

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.009 Low

EPSS

Percentile

82.8%

JSON

The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file.

CPENameOperatorVersion
php:phpphpeq4.3.9
php:phpphpeq4.4.9
php:phpphpeq4.0
php:phpphpeq4.2.0
php:phpphpeq4.4.4
php:phpphpeq4.1.0
php:phpphpeq4.3.4
php:phpphpeq4.0.4
php:phpphpeq4.3.0
php:phpphpeq4.0.5

CPE	Name	Operator	Version
php:php	php	eq	4.3.9
php:php	php	eq	4.4.9
php:php	php	eq	4.0
php:php	php	eq	4.2.0
php:php	php	eq	4.4.4
php:php	php	eq	4.1.0
php:php	php	eq	4.3.4
php:php	php	eq	4.0.4
php:php	php	eq	4.3.0
php:php	php	eq	4.0.5