PHP 'com_event_sink()' Function Arbitrary Code Execution Vulnerability

Bugtraq ID:	53642
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 21 2012 12:00AM
Updated:	May 21 2012 12:00AM
Credit:	condis
Vulnerable:	PHP PHP 5.4.3 PHP PHP 5.3.8 PHP PHP 5.3.10
Not Vulnerable:

PHP 'com_event_sink()' Function Arbitrary Code Execution Vulnerability

PHP is prone to an arbitrary-code-execution vulnerability.

An attacker could exploit this issue to execute arbitrary code in the context of the application. Failed exploits will result in a denial-of-service condition.

PHP 5.4.3 and prior are vulnerable.

PHP 'com_event_sink()' Function Arbitrary Code Execution Vulnerability

The following proof of concept and exploit codes are available:

• /data/vulnerabilities/exploits/53642.txt
• /data/vulnerabilities/exploits/53642.php.txt

PHP 'com_event_sink()' Function Arbitrary Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

PHP 'com_event_sink()' Function Arbitrary Code Execution Vulnerability

References:

• PHP Homepage (PHP)