CVE-2005-3389 Security feature bypass in n/a
Remote attackers can bypass register_globals protections in PHP applications by triggering a memory limit error during parse_str execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2005-3389?
CVE-2005-3389 is a medium-severity vulnerability in Php Php, published on 1 Nov 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The parse_str function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the register_globals directive via inputs that cause a request to be terminated due to the memory_limit setting, which causes PHP to set an internal flag that enables register_globals and allows attackers to exploit vulnerabilities in PHP applications that would otherwise be protected.
Which versions are affected by CVE-2005-3389?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2005-3389?
Upgrade to a fixed version.
Is CVE-2005-3389 being exploited?
There is no known exploitation of CVE-2005-3389 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-7vjg-5rq8-r4h2.