News Feed
Jobs Feed

News Archive
Looking for more information on how to do PHP the right way? Check out PHP: The Right Way
PHP "glob()" Code Execution Vulnerability
July 16, 2007 @ 13:52:38

As reported here on Secunia (as discovered by shinnai), there's a code execution vulnerability in PHP's glob function:

The vulnerability is caused due to an error in the handling of an uninitialized structure inside the "glob()" function. This can be exploited to execute arbitrary code, which may lead to security restrictions (e.g. the "disable_functions" directive) being bypassed.

The vulnerability is confirmed in the 5.2.3 win32 installer. Other versions may also be affected.

The issue is marked as "less critical" and can be avoided easily by only allowing trusted users the correct permissions to execute PHP code on the server.

0 comments voice your opinion now!
glob vulnerability execution bypass security glob vulnerability execution bypass security

blog comments powered by Disqus

Similar Posts TCExam PHP Code Execution and Cross-Site Scripting

Devshed: Putting Apache in Jail (including PHP)

Benjamin Eberlei: Decoupling from Symfony Security and FOSUserBundle

Pádraic Brady: Getting Ahead In Security By Watching The Neighbours

PHP Security Blog: phpBB exploit in the wild

Community Events

Don't see your event here?
Let us know!

install code composer facebook overview series language component hhvm unittest release framework opinion security introduction hack podcast package application symfony2

All content copyright, 2014 :: - Powered by the Solar PHP Framework