From: john at jelsoft dot com Operating system: All PHP version: 4.3.10 PHP Bug Type: Scripting Engine problem Bug description: GLOBALS array overwritten from GET/POST/COOKIE vars
Description: ------------ With register_globals on it is possible to overwrite the $GLOBALS array from GET/POST/COOKIE vars. For example, try the script below: script.php (will print the full GLOBALS array) script.php?GLOBALS[php]=error (will print a GLOBALS array with just one entry) _GET, _POST, etc superglobals are no vulnerable. PHP5 does not exhibit this behaviour. Reproduce code: --------------- <a href="script.php?GLOBALS[php]=error">kill GLOBALS</a> <pre> <?php print_r( $GLOBALS ); ?> </pre> Expected result: ---------------- Full display of GLOBALS array Actual result: -------------- GLOBALS array with just one entry -- Edit bug report at http://bugs.php.net/?id=31440&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=31440&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=31440&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=31440&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=31440&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=31440&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=31440&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=31440&r=needscript Try newer version: http://bugs.php.net/fix.php?id=31440&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=31440&r=support Expected behavior: http://bugs.php.net/fix.php?id=31440&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=31440&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=31440&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=31440&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=31440&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=31440&r=dst IIS Stability: http://bugs.php.net/fix.php?id=31440&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=31440&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=31440&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=31440&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=31440&r=mysqlcfg
