#31440 [NEW]: GLOBALS array overwritten from GET/POST/COOKIE vars

From: Date: Fri, 07 Jan 2005 12:36:50 +0000
Subject: #31440 [NEW]: GLOBALS array overwritten from GET/POST/COOKIE vars
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-71558@lists.php.net to get a copy of this message 
From:             john at jelsoft dot com
Operating system: All
PHP version:      4.3.10
PHP Bug Type:     Scripting Engine problem
Bug description:  GLOBALS array overwritten from GET/POST/COOKIE vars

Description:
------------
With 
register_globals on 
it is possible to overwrite the $GLOBALS array from GET/POST/COOKIE vars.

For example, try the script below:

script.php
(will print the full GLOBALS array)

script.php?GLOBALS[php]=error
(will print a GLOBALS array with just one entry)

_GET, _POST, etc superglobals are no vulnerable.
PHP5 does not exhibit this behaviour.


Reproduce code:
---------------
<a href="script.php?GLOBALS[php]=error">kill GLOBALS</a>

<pre>
<?php

print_r( $GLOBALS );

?>
</pre>


Expected result:
----------------
Full display of GLOBALS array

Actual result:
--------------
GLOBALS array with just one entry

-- 
Edit bug report at http://bugs.php.net/?id=31440&edit=1
-- 
Try a CVS snapshot (php4):   http://bugs.php.net/fix.php?id=31440&r=trysnapshot4
Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=31440&r=trysnapshot50
Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=31440&r=trysnapshot51
Fixed in CVS:                http://bugs.php.net/fix.php?id=31440&r=fixedcvs
Fixed in release:            http://bugs.php.net/fix.php?id=31440&r=alreadyfixed
Need backtrace:              http://bugs.php.net/fix.php?id=31440&r=needtrace
Need Reproduce Script:       http://bugs.php.net/fix.php?id=31440&r=needscript
Try newer version:           http://bugs.php.net/fix.php?id=31440&r=oldversion
Not developer issue:         http://bugs.php.net/fix.php?id=31440&r=support
Expected behavior:           http://bugs.php.net/fix.php?id=31440&r=notwrong
Not enough info:             http://bugs.php.net/fix.php?id=31440&r=notenoughinfo
Submitted twice:             http://bugs.php.net/fix.php?id=31440&r=submittedtwice
register_globals:            http://bugs.php.net/fix.php?id=31440&r=globals
PHP 3 support discontinued:  http://bugs.php.net/fix.php?id=31440&r=php3
Daylight Savings:            http://bugs.php.net/fix.php?id=31440&r=dst
IIS Stability:               http://bugs.php.net/fix.php?id=31440&r=isapi
Install GNU Sed:             http://bugs.php.net/fix.php?id=31440&r=gnused
Floating point limitations:  http://bugs.php.net/fix.php?id=31440&r=float
No Zend Extensions:          http://bugs.php.net/fix.php?id=31440&r=nozend
MySQL Configuration Error:   http://bugs.php.net/fix.php?id=31440&r=mysqlcfg

Thread (18 messages)

« previous php.bugs (#71558) next »