CVE-2012-0831

PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html	Mailing List Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080037.html	Mailing List Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080041.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00001.html	Mailing List Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1307.html	Third Party Advisory
http://secunia.com/advisories/48668	Third Party Advisory
http://secunia.com/advisories/55078	Third Party Advisory
http://support.apple.com/kb/HT5501	Third Party Advisory
http://svn.php.net/viewvc?view=revision&revision=323016	Vendor Advisory
http://www.securityfocus.com/bid/51954	Patch Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-1358-1	Patch Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/73125	Third Party Advisory VDB Entry
https://launchpadlibrarian.net/92454212/php5_5.3.2-1ubuntu4.13.diff.gz	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

History

16 Aug 2022, 13:31

Information

Published : 2012-02-10 20:55

Updated : 2024-02-04 17:54

NVD link : CVE-2012-0831

Mitre link : CVE-2012-0831

CVE.ORG link : CVE-2012-0831

JSON object : View

Products Affected

php

CWE

CWE-20

Improper Input Validation

Type	Values Removed	Values Added
References	~~(APPLE) http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html -~~	(APPLE) http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html - Mailing List, Third Party Advisory
References	~~(SUSE) http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html -~~	(SUSE) http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html - Mailing List, Third Party Advisory
References	~~(SUSE) http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html -~~	(SUSE) http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html - Mailing List, Third Party Advisory
References	~~(FEDORA) http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080037.html -~~	(FEDORA) http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080037.html - Mailing List, Third Party Advisory
References	~~(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/73125 -~~	(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/73125 - Third Party Advisory, VDB Entry
References	~~(SUSE) http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00001.html -~~	(SUSE) http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00001.html - Mailing List, Third Party Advisory
References	~~(REDHAT) http://rhn.redhat.com/errata/RHSA-2013-1307.html -~~	(REDHAT) http://rhn.redhat.com/errata/RHSA-2013-1307.html - Third Party Advisory
References	~~(CONFIRM) http://support.apple.com/kb/HT5501 -~~	(CONFIRM) http://support.apple.com/kb/HT5501 - Third Party Advisory
References	~~(SECUNIA) http://secunia.com/advisories/48668 - Vendor Advisory~~	(SECUNIA) http://secunia.com/advisories/48668 - Third Party Advisory
References	~~(CONFIRM) http://svn.php.net/viewvc?view=revision&revision=323016 -~~	(CONFIRM) http://svn.php.net/viewvc?view=revision&revision=323016 - Vendor Advisory
References	~~(BID) http://www.securityfocus.com/bid/51954 - Patch~~	(BID) http://www.securityfocus.com/bid/51954 - Patch, Third Party Advisory, VDB Entry
References	~~(FEDORA) http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080041.html -~~	(FEDORA) http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080041.html - Mailing List, Third Party Advisory
References	~~(UBUNTU) http://www.ubuntu.com/usn/USN-1358-1 - Patch~~	(UBUNTU) http://www.ubuntu.com/usn/USN-1358-1 - Patch, Third Party Advisory
References	~~(CONFIRM) https://launchpadlibrarian.net/92454212/php5_5.3.2-1ubuntu4.13.diff.gz - Exploit~~	(CONFIRM) https://launchpadlibrarian.net/92454212/php5_5.3.2-1ubuntu4.13.diff.gz - Exploit, Third Party Advisory
References	~~(SECUNIA) http://secunia.com/advisories/55078 -~~	(SECUNIA) http://secunia.com/advisories/55078 - Third Party Advisory
CPE	cpe:2.3:a:php:php:4.0.1:::::::* cpe:2.3:a:php:php:5.2.9:::::::* cpe:2.3:a:php:php:3.0.11:::::::* cpe:2.3:a:php:php:5.2.8:::::::* cpe:2.3:a:php:php:4.0.0:::::::* cpe:2.3:a:php:php:4.3.9:::::::* cpe:2.3:a:php:php:5.3.9:::::::* cpe:2.3:a:php:php:5.0.0:beta2:::::: cpe:2.3:a:php:php:3.0.6:::::::* cpe:2.3:a:php:php:5.2.0:::::::* cpe:2.3:a:php:php:5.2.6:::::::* cpe:2.3:a:php:php:5.0.0:beta4:::::: cpe:2.3:a:php:php:5.1.5:::::::* cpe:2.3:a:php:php:5.0.0:rc2:::::: cpe:2.3:a:php:php:5.3.8:::::::* cpe:2.3:a:php:php:3.0.12:::::::* cpe:2.3:a:php:php:4.0.7:::::::* cpe:2.3:a:php:php:4.0:beta3:::::: cpe:2.3:a:php:php:5.3.10:::::::* cpe:2.3:a:php:php:4.4.3:::::::* cpe:2.3:a:php:php:5.3.1:::::::* cpe:2.3:a:php:php:5.0.4:::::::* cpe:2.3:a:php:php:5.1.6:::::::* cpe:2.3:a:php:php:5.2.13:::::::* cpe:2.3:a:php:php:3.0.14:::::::* cpe:2.3:a:php:php:4.1.2:::::::* cpe:2.3:a:php:php:5.2.10:::::::* cpe:2.3:a:php:php:4.3.11:::::::* cpe:2.3:a:php:php:4.4.7:::::::* cpe:2.3:a:php:php:5.0.2:::::::* cpe:2.3:a:php:php:5.1.0:::::::* cpe:2.3:a:php:php:4.4.4:::::::* cpe:2.3:a:php:php:5.2.4:::::::* cpe:2.3:a:php:php:5.3.0:::::::* cpe:2.3:a:php:php:3.0.5:::::::* cpe:2.3:a:php:php:5.3.5:::::::* cpe:2.3:a:php:php:4.3.2:::::::* cpe:2.3:a:php:php:4.0.3:::::::* cpe:2.3:a:php:php:5.3.2:::::::* cpe:2.3:a:php:php:5.0.5:::::::* cpe:2.3:a:php:php:4.3.1:::::::* cpe:2.3:a:php:php:5.3.4:::::::* cpe:2.3:a:php:php:5.0.1:::::::* cpe:2.3:a:php:php:3.0.7:::::::* cpe:2.3:a:php:php:5.2.11:::::::* cpe:2.3:a:php:php:4.3.5:::::::* cpe:2.3:a:php:php:4.3.0:::::::* cpe:2.3:a:php:php:5.2.5:::::::* cpe:2.3:a:php:php:3.0.10:::::::* cpe:2.3:a:php:php:5.1.2:::::::* cpe:2.3:a:php:php:5.3.7:::::::* cpe:2.3:a:php:php:5.3.3:::::::* cpe:2.3:a:php:php:4.2.3:::::::* cpe:2.3:a:php:php:5.0.0:beta3:::::: cpe:2.3:a:php:php:2.0b10:::::::* cpe:2.3:a:php:php:4.3.8:::::::* cpe:2.3:a:php:php:5.0.3:::::::* cpe:2.3:a:php:php:5.2.1:::::::* cpe:2.3:a:php:php:4.1.0:::::::* cpe:2.3:a:php:php:4.4.9:::::::* cpe:2.3:a:php:php:3.0.13:::::::* cpe:2.3:a:php:php:5.2.15:::::::* cpe:2.3:a:php:php:4.2.1:::::::* cpe:2.3:a:php:php:5.0.0:beta1:::::: cpe:2.3:a:php:php:4.4.0:::::::* cpe:2.3:a:php:php:2.0:::::::* cpe:2.3:a:php:php:4.0:beta_4_patch1:::::: cpe:2.3:a:php:php:5.0.0:rc1:::::: cpe:2.3:a:php:php:3.0.9:::::::* cpe:2.3:a:php:php:5.0.0:::::::* cpe:2.3:a:php:php:4.0.4:::::::* cpe:2.3:a:php:php:5.2.3:::::::* cpe:2.3:a:php:php:4.4.2:::::::* cpe:2.3:a:php:php:4.3.4:::::::* cpe:2.3:a:php:php:4.3.6:::::::* cpe:2.3:a:php:php:3.0.8:::::::* cpe:2.3:a:php:php:3.0.2:::::::* cpe:2.3:a:php:php:4.2.2:::::::* cpe:2.3:a:php:php:5.2.14:::::::* cpe:2.3:a:php:php:3.0.3:::::::* cpe:2.3:a:php:php:5.0.0:rc3:::::: cpe:2.3:a:php:php:3.0.1:::::::* cpe:2.3:a:php:php:5.3.6:::::::* cpe:2.3:a:php:php:4.0:beta1:::::: cpe:2.3:a:php:php:4.4.8:::::::* cpe:2.3:a:php:php:5.1.3:::::::* cpe:2.3:a:php:php:4.0.2:::::::* cpe:2.3:a:php:php:4.2.0:::::::* cpe:2.3:a:php:php:3.0.15:::::::* cpe:2.3:a:php:php:4.3.7:::::::* cpe:2.3:a:php:php:4.3.3:::::::* cpe:2.3:a:php:php:5.2.16:::::::* cpe:2.3:a:php:php:4.0.6:::::::* cpe:2.3:a:php:php:4.1.1:::::::* cpe:2.3:a:php:php:3.0.18:::::::* cpe:2.3:a:php:php:3.0.17:::::::* cpe:2.3:a:php:php:3.0.4:::::::* cpe:2.3:a:php:php:3.0:::::::* cpe:2.3:a:php:php:4.4.6:::::::* cpe:2.3:a:php:php:4.0.5:::::::* cpe:2.3:a:php:php:4.4.1:::::::* cpe:2.3:a:php:php:4.0:beta4:::::: cpe:2.3:a:php:php:5.2.2:::::::* cpe:2.3:a:php:php:4.4.5:::::::* cpe:2.3:a:php:php:3.0.16:::::::* cpe:2.3:a:php:php:5.1.1:::::::* cpe:2.3:a:php:php:4.3.10:::::::* cpe:2.3:a:php:php:5.1.4:::::::* cpe:2.3:a:php:php:1.0:::::::* cpe:2.3:a:php:php:4.0:beta2:::::: cpe:2.3:a:php:php:5.2.12:::::::*

6.8 /10