CVE-2004-0958
PHP < 5.0.2 - Memory Contents Exposure via GPC Variables Ending in Open Bracket
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2004-0958. PoCs published by Stefano Di Paola.
AI-analyzed exploit summary This exploit leverages a memory disclosure vulnerability in PHP's array parsing functions by sending a crafted URI parameter to a PHP script that prints user-supplied data. The vulnerability allows an attacker to read regions of process memory by manipulating the parsing function.
Description
php_variables.c in PHP before 5.0.2 allows remote attackers to read sensitive memory contents via (1) GET, (2) POST, or (3) COOKIE GPC variables that end in an open bracket character, which causes PHP to calculate an incorrect string length.
Exploits (1)
This exploit leverages a memory disclosure vulnerability in PHP's array parsing functions by sending a crafted URI parameter to a PHP script that prints user-supplied data. The vulnerability allows an attacker to read regions of process memory by manipulating the parsing function.