Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
PHP文件上传$GLOBALS变量覆盖漏洞
Vulnerability Description
PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP在全局变量的保护上存在漏洞，攻击者可以通过发送包含有GLOBALS名称文件上传字段的POST请求覆盖$GLOBALS数组，导致可能远程执行PHP代码。PHP 4.3.11添加了一些代码禁止在打开register_globals时覆盖$GLOBALS数组，但这种保护中存在漏洞。引入的代码仅影响GET、POST和COOKIE变量的全局化，但忽略了PHP中的rfc1867文件上传代码也注册了全局变量。
CVSS Information
N/A
Vulnerability Type
N/A