php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Sec Bug #69206 Nullbytes - The Come back
Submitted: 2015-03-09 17:34 UTC Modified: 2015-03-20 05:50 UTC
From: habte dot yibelo at gmail dot com Assigned:
Status: Duplicate Package: PHP Language Specification
PHP Version: Irrelevant OS: *
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: habte dot yibelo at gmail dot com
New email:
PHP Version: OS:

 

 [2015-03-09 17:34 UTC] habte dot yibelo at gmail dot com 
Description:
------------
with newer versions of PHP, we all taught Nullbytes issues were over. but there is still one simple bypass and I still have no clue why there is.



Test script:
---------------
move_uploaded_file($_FILES['x']['tmp_name'],"/tmp/test.php\x00.jpg")

That file will create what you think it shouldn't!

Actual result:
--------------
I expect the fix of the next version to notice nullbytes and actually not ignore them this time.

Thanks!

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-03-09 18:25 UTC] stas@php.net
-Status: Open +Status: Duplicate
 [2015-03-09 18:25 UTC] stas@php.net 
Dupe of #69207
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Tue May 13 01:01:28 2025 UTC