CVE-2005-3390: High severity PHP PHP vulnerability

Published Nov 1, 2005

Updated

The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when registerglobals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.

Affected Software

63 affected components

PHP PHP=4.3.9

PHP PHP=3.0

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=4.2.0

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=3.0.8

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=5.0.1

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=3.0.6

PHP PHP=4.0.3-patch1

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=5.0.3

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=4.0.1-patch1

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=5.0-rc2

PHP PHP=4.1.2

PHP PHP=4.0.7-rc3

PHP PHP=4.3.1

PHP PHP=3.0.18

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=4.0.1

PHP PHP=5.0.2

PHP PHP=3.0.12

PHP PHP=4.2

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

Remediation

Event History

Nov 1, 2005

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-3390?

CVE-2005-3390 is considered a high-severity vulnerability due to its ability to allow remote attackers to modify the GLOBALS array in PHP.

How do I fix CVE-2005-3390?

To fix CVE-2005-3390, disable the register_globals directive in PHP and upgrade to a version of PHP that is not affected.

Which versions of PHP are affected by CVE-2005-3390?

CVE-2005-3390 affects PHP versions 4.x up to 4.4.0 and 5.x up to 5.0.5.

Can CVE-2005-3390 be exploited remotely?

Yes, CVE-2005-3390 can be exploited by remote attackers through specially crafted multipart/form-data POST requests.

What type of applications are vulnerable due to CVE-2005-3390?

PHP applications that have the register_globals feature enabled are vulnerable to CVE-2005-3390.

CVE-2005-3390: High severity PHP PHP vulnerability

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2005-3390?

How do I fix CVE-2005-3390?

Which versions of PHP are affected by CVE-2005-3390?

Can CVE-2005-3390 be exploited remotely?

What type of applications are vulnerable due to CVE-2005-3390?

Company

Resources

Contact