QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2011-2202

Back to search

CVE-2011-2202

Published: Jun 16, 2011

Modified: Aug 6, 2024

PUBLISHED

Description

The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."

VendorProductVersions

n/a

n/a

affected
n/a

References

48259
vdb-entry
x_refsource_BID
HPSBOV02763
vendor-advisory
x_refsource_HP
49241
vdb-entry
x_refsource_BID
1025659
vdb-entry
x_refsource_SECTRACK
MDVSA-2011:165
vendor-advisory
x_refsource_MANDRIVA
44874
third-party-advisory
x_refsource_SECUNIA
DSA-2266
vendor-advisory
x_refsource_DEBIAN
APPLE-SA-2012-02-01-1
vendor-advisory
x_refsource_APPLE
SSRT100826
vendor-advisory
x_refsource_HP
RHSA-2011:1423
vendor-advisory
x_refsource_REDHAT
RHSA-2012:0071
vendor-advisory
x_refsource_REDHAT

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now