Описание
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2012-5653
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80795
- http://drupal.org/SA-CORE-2012-004
- http://drupalcode.org/project/drupal.git/commitdiff/b47f95d
- http://drupalcode.org/project/drupal.git/commitdiff/da8023a
- http://osvdb.org/88529
- http://www.debian.org/security/2013/dsa-2776
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:074
- http://www.openwall.com/lists/oss-security/2012/12/20/1
- http://www.securityfocus.com/bid/56993
Связанные уязвимости
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 ...