#VU110514 Input validation error in PHP - CVE-2004-1020

Vulnerability identifier: #VU110514

Vulnerability risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2004-1020

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
PHP
Universal components / Libraries / Scripting languages

Vendor: PHP Group

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magic_quotes_gpc mechanism. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

Mitigation
Install update from vendor's website.

Vulnerable software versions

PHP: 4.3.6, 4.3.7, 4.3.8, 4.3.9, 5, 5.0.0, 5.0.1, 5.0.2

---

External links
https://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915
https://www.gentoo.org/security/en/glsa/glsa-200412-14.xml
https://www.mandriva.com/security/advisories?name=MDKSA-2004:151
https://www.php.net/release_4_3_10.php
https://www.securityfocus.com/advisories/9028
https://www.securityfocus.com/archive/1/384663
https://www.securityfocus.com/bid/11981
https://exchange.xforce.ibmcloud.com/vulnerabilities/18516

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.