Description

This alert was generated using only banner information. It may be a false positive.

PHP applications can be manipulated into opening arbitrary files on the server, rather than those uploaded by the user.

Affected PHP versions (up to 3.0.16, 4.0.2).

Remediation

Upgrade PHP to the latest version.

References

BID 1649

PHP Homepage

Related Vulnerabilities

PHP Integer Overflow or Wraparound Vulnerability (CVE-2016-6207)

WordPress Plugin Ultimate FAQ Security Bypass (1.8.24)

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-2092)

PHP Other Vulnerability (CVE-2007-1777)

TYPO3 Cleartext Storage of Sensitive Information Vulnerability (CVE-2021-21339)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure CWE-538 CVE-2000-0860