#31440 [Ver]: [PATCH] GLOBALS array overwritten from GET/POST/COOKIE vars

From: Date: Thu, 17 Feb 2005 04:28:04 +0000
Subject: #31440 [Ver]: [PATCH] GLOBALS array overwritten from GET/POST/COOKIE vars
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-74189@lists.php.net to get a copy of this message 
 ID:               31440
 Updated by:       sniper@php.net
 Reported By:      john at jelsoft dot com
 Status:           Verified
 Bug Type:         Scripting Engine problem
 Operating System: *
 PHP Version:      4CVS, 5CVS (2005-02-15)
 New Comment:

Here's better patch, by Ilia:

  http://www.php.net/~jani/patches/bug31440.patch




Previous Comments:
------------------------------------------------------------------------

[2005-02-15 12:49:55] sniper@php.net

note: In HEAD you _can_ overwrite GLOBALS with this:

script.php?GLOBALS=error

but NOT with this:

script.php?GLOBALS[php]=error

------------------------------------------------------------------------

[2005-02-15 12:48:48] sniper@php.net

Here are some patches I wrote to fix this:

For PHP_4_3 branch: 
  http://www.php.net/~jani/patches/bug31440.php_4_3_patch
 
For HEAD branch:
  http://www.php.net/~jani/patches/bug31440.php_HEAD_patch


------------------------------------------------------------------------

[2005-01-07 13:36:49] john at jelsoft dot com

Description:
------------
With 
register_globals on 
it is possible to overwrite the $GLOBALS array from GET/POST/COOKIE
vars.

For example, try the script below:

script.php
(will print the full GLOBALS array)

script.php?GLOBALS[php]=error
(will print a GLOBALS array with just one entry)

_GET, _POST, etc superglobals are no vulnerable.
PHP5 does not exhibit this behaviour.


Reproduce code:
---------------
<a href="script.php?GLOBALS[php]=error">kill GLOBALS</a>

<pre>
<?php

print_r( $GLOBALS );

?>
</pre>


Expected result:
----------------
Full display of GLOBALS array

Actual result:
--------------
GLOBALS array with just one entry


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=31440&edit=1

Thread (18 messages)

« previous php.bugs (#74189) next »