Description:
------------
1. test environment : windows php 5.6.7

2. technical detail

preg_match function compare regular espression and input of user.
but if input value is array it fail to compare.
As a result following script continuously execute. Attacker can bypass preg_macth function and take place side effect of various case. 




Test script:
---------------
this is poc of vulnerability.

http://192.168.0.2/test.php?input[]=abc'def

<?
$a = $_GET['input'];
if(preg_match("~[^0-9a-z+\\.]~",$a,$match)) { // special char check
	echo "you can't execute following script";
	exit;
}
system("touch filename");
echo "why i am here";
?>

Expected result:
----------------
"why i am here" print