PHP 'mb_ereg_replace()' String Evaluation Vulnerability
BID:34873
Info
PHP 'mb_ereg_replace()' String Evaluation Vulnerability
| Bugtraq ID: | 34873 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | May 07 2009 12:00AM |
| Updated: | May 08 2009 01:06AM |
| Credit: | 80vul |
| Vulnerable: |
PHP PHP 5.2.9 -2 PHP PHP 5.2.9 PHP PHP 5.2.8 PHP PHP 5.2.7 PHP PHP 5.2.6 PHP PHP 5.2.5 PHP PHP 5.2.4 PHP PHP 5.2.3 PHP PHP 5.2.2 PHP PHP 5.2.1 PHP PHP 5.1.6 PHP PHP 5.1.5 PHP PHP 5.1.4 PHP PHP 5.1.3 -RC1 PHP PHP 5.1.3 PHP PHP 5.1.2 PHP PHP 5.1.1 PHP PHP 5.1 PHP PHP 5.0.5 PHP PHP 5.0.4 PHP PHP 5.0.3 PHP PHP 5.0.2 PHP PHP 5.0.1 PHP PHP 5.0 candidate 3 PHP PHP 5.0 candidate 2 PHP PHP 5.0 candidate 1 PHP PHP 5.0 .0 PHP PHP 4.4.9 PHP PHP 4.4.8 PHP PHP 4.4.7 PHP PHP 4.4.6 PHP PHP 4.4.5 PHP PHP 4.4.4 PHP PHP 4.4.3 PHP PHP 4.4.2 PHP PHP 4.4.1 PHP PHP 4.4 .0 PHP PHP 4.3.11 PHP PHP 4.3.10 PHP PHP 4.3.9 PHP PHP 4.3.8 PHP PHP 4.3.7 PHP PHP 4.3.6 PHP PHP 4.3.5 PHP PHP 4.3.4 PHP PHP 4.3.3 PHP PHP 4.3.2 PHP PHP 4.3.1 PHP PHP 4.3 PHP PHP 4.2.3 PHP PHP 4.2.2 PHP PHP 4.2.1 PHP PHP 4.2 .0 PHP PHP 5.2 |
| Not Vulnerable: | |
Discussion
PHP 'mb_ereg_replace()' String Evaluation Vulnerability
The 'mb_ereg_replace()' function of PHP is prone to a vulnerability that can result in the improper evaluation of user-supplied input.
Exploiting this issue may allow attackers to execute arbitrary PHP commands in the context of the affected application.
The 'mb_ereg_replace()' function of PHP is prone to a vulnerability that can result in the improper evaluation of user-supplied input.
Exploiting this issue may allow attackers to execute arbitrary PHP commands in the context of the affected application.
Exploit / POC
PHP 'mb_ereg_replace()' String Evaluation Vulnerability
The following example is available:
The following example is available:
Solution / Fix
PHP 'mb_ereg_replace()' String Evaluation Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
PHP 'mb_ereg_replace()' String Evaluation Vulnerability
References:
References: