PHP MySQLi Extension 'set_magic_quotes_runtime' Function Security-Bypass Weakness

Bugtraq ID:	46056
Class:	Design Error
CVE:	CVE-2010-4700
Remote:	Yes
Local:	No
Published:	Jan 28 2011 12:00AM
Updated:	Jan 28 2011 12:00AM
Credit:	m.philipp
Vulnerable:	PHP PHP 5.3.2 PHP PHP 5.3.3
Not Vulnerable:	PHP PHP 5.3.4

PHP MySQLi Extension 'set_magic_quotes_runtime' Function Security-Bypass Weakness

PHP is prone to a security-bypass weakness.

Successful exploits will allow attackers to possibly bypass certain security protections.

PHP 5.3.2 and 5.3.3 are vulnerable.

PHP MySQLi Extension 'set_magic_quotes_runtime' Function Security-Bypass Weakness

Attackers can use a browser to exploit this issue.

PHP MySQLi Extension 'set_magic_quotes_runtime' Function Security-Bypass Weakness

Solution:
Updates are available. Please see the references for more information.

PHP MySQLi Extension 'set_magic_quotes_runtime' Function Security-Bypass Weakness

References:

• Bug #52221 Misbehaviour of magic_quotes_runtime (get/set) (m.philipp)
  
• PHP Changelog (PHP)
  
• PHP Homepage (PHP)