Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The parse_str function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the register_globals directive via inputs that cause a request to be terminated due to the memory_limit setting, which causes PHP to set an internal flag that enables register_globals and allows attackers to exploit vulnerabilities in PHP applications that would otherwise be protected.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
PHP parse_str()函数激活register_globals变量漏洞
Vulnerability Description
PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的parse_str()函数在处理参数时存在漏洞，攻击者可以利用这个漏洞启用register_globals，从而进一步利用其他PHP脚本中的漏洞。 如果仅以一个参数调用parse_str()的话，该函数会认为该参数是通过URL传送的请求字符串那样解析所提供的字符串，但外部攻击者可以在调用parse_str()期间发送很多请求变量来触发memory_limit请求终止。如果在调用parse_str()期间执行了请求关闭的
CVSS Information
N/A
Vulnerability Type
N/A