CVE-2005-3390

The record

The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.

Affected packages

Related vulnerabilities

• CVE-2009-4017 PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files… Also affects php
• CVE-2009-3546 The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD… Also affects php
• CVE-2007-1825 Buffer overflow in the imap_mail_compose function in PHP 5 before 5.2.1, and PHP 4 before… Also affects php
• CVE-2007-1286 Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to… Also affects php
• CVE-2007-1285 The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to… Also affects php
• CVE-2007-0908 The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5… Also affects php
• CVE-2007-0455 Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33… Also affects php
• CVE-2006-1990 Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow… Also affects php