NVD

Id
9019  
Name
CVE-2011-2202  
Description
The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-06-16  
Modified Date
2016-08-22  
Seq
2011-2202  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
51788 9019 CVE-2011-2202 http://bugs.php.net/bug.php?id=54939  View
51789 9019 CVE-2011-2202 APPLE-SA-2012-02-01-1  View
51790 9019 CVE-2011-2202 SSRT100826  View
51791 9019 CVE-2011-2202 [oss-security] 20110612 CVE Request: PHP File upload filename  View
51792 9019 CVE-2011-2202 [oss-security] 20110613 Re: CVE Request: PHP File upload filename  View
51793 9019 CVE-2011-2202 http://pastebin.com/1edSuSVN  View
51794 9019 CVE-2011-2202 RHSA-2012:0071  View
51795 9019 CVE-2011-2202 1025659  View
51796 9019 CVE-2011-2202 http://support.apple.com/kb/HT5130  View
51797 9019 CVE-2011-2202 http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/main/rfc1867.c?r1=312103&r2=312102&pathrev=312103  View
51798 9019 CVE-2011-2202 http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/NEWS?view=markup&pathrev=312103  View
51799 9019 CVE-2011-2202 http://svn.php.net/viewvc?view=revision&revision=312103  View
51800 9019 CVE-2011-2202 DSA-2266  View
51801 9019 CVE-2011-2202 MDVSA-2011:165  View
51802 9019 CVE-2011-2202 http://www.php.net/archive/2011.php#id2011-08-18-1  View
51803 9019 CVE-2011-2202 http://www.php.net/ChangeLog-5.php#5.3.7  View
51804 9019 CVE-2011-2202 RHSA-2011:1423  View
51805 9019 CVE-2011-2202 48259  View
51806 9019 CVE-2011-2202 49241  View
51807 9019 CVE-2011-2202 php-sapiposthandlerfunc-sec-bypass(67999)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
31968 JVNDB-2011-002208 PHP の main/rfc1867.c 内にある rfc1867_post_handler 関数における任意のファイルを作成される脆弱性 PHP の main/rfc1867.c 内にある rfc1867_post_handler 関数は、multipart/form-data POST リクエストのファイル名を適切に制限しないため、任意のファイルを作成される、または上書きされる脆弱性が存在します。 CVE-2011-2202 50109 CVE-2011-2202 9019 6.4 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-002208.html 2011-06-16 2011-09-13 View