CVE-2012-0831
MEDIUM severity · CVSS 6.8 · Improper input validation
6.8CVSS MEDIUM
Summary
PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c.
Impact & exploitability
Attack vectorNetwork
Attack complexity—
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impact—
Exploit probability (EPSS)6%
AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.htmlAdvisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080037.htmlAdvisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080041.htmlAdvisory
- http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.htmlAdvisory
- http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.htmlAdvisory
- http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00001.htmlAdvisory
- http://rhn.redhat.com/errata/RHSA-2013-1307.htmlAdvisory
- http://secunia.com/advisories/48668Advisory