Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
PHP Improper Access Control Vulnerability - CVE-2016-5385 - Vulnerability Database
PHP

PHP Improper Access Control Vulnerability - CVE-2016-5385

High
Reference: CVE-2016-5385
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2016-5385
Title: PHP Improper Access Control Vulnerability
Overview:

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable which might allow remote attackers to redirect an application39s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request as demonstrated by (1) an application that makes a getenv(39HTTP_PROXY39) call or (2) a CGI configuration of PHP aka an quothttpoxyquot issue.