CVE

Id
8970  
CVE No.
CVE-2004-0542  
Status
Candidate  
Description
PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd function, or (2) the "%" character to the escapeshellarg function.  
Phase
Assigned (20040608)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
57674 8970 CVE-2004-0542 MISC:http://www.idefense.com/application/poi/display?id=108  View
57675 8970 CVE-2004-0542 CONFIRM:http://www.php.net/release_4_3_7.php  View
57676 8970 CVE-2004-0542 XF:php-escapeshellarg-execute-command(16331)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
63258 JVNDB-2004-000615 Oracle E-Business Suite に SQL インジェクションの脆弱性 Oracle Applications 11.0 全リリースならびに、Oracle E-Business Suite リリース11i (R11.5.1-R11.5.8) には、SQL インジェクションに関する脆弱性が存在します。 CVE-2004-0543 8970 10 http://jvndb.jvn.jp/ja/contents/2004/JVNDB-2004-000615.html  View