PHP 'create_function()' Code Injection Weakness
BID:31398
Info
PHP 'create_function()' Code Injection Weakness
| Bugtraq ID: | 31398 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 25 2008 12:00AM |
| Updated: | Sep 26 2008 04:29PM |
| Credit: | 80sec |
| Vulnerable: |
PHP PHP 5.2.6 |
| Not Vulnerable: | |
Discussion
PHP 'create_function()' Code Injection Weakness
PHP is prone to a code-injection weakness because it fails to sufficiently sanitize input to 'create_function()'. Note that the anonymous function returned need not be called for the supplied code to be executed.
An attacker who can exploit this weakness will be able to execute code with the privileges of an additional vulnerable program.
This weakness is reported in PHP 5.2.6; other versions may also be affected.
PHP is prone to a code-injection weakness because it fails to sufficiently sanitize input to 'create_function()'. Note that the anonymous function returned need not be called for the supplied code to be executed.
An attacker who can exploit this weakness will be able to execute code with the privileges of an additional vulnerable program.
This weakness is reported in PHP 5.2.6; other versions may also be affected.
Exploit / POC
PHP 'create_function()' Code Injection Weakness
The following examples are available:
The following examples are available:
Solution / Fix
PHP 'create_function()' Code Injection Weakness
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
PHP 'create_function()' Code Injection Weakness
References:
References: