What’s Vulnerable › Vulnerabilities

CVE-2005-3389

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2005-11-01 · updated 2026-06-16

Description

The parse_str function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the register_globals directive via inputs that cause a request to be terminated due to the memory_limit setting, which causes PHP to set an internal flag that enables register_globals and allows attackers to exploit vulnerabilities in PHP applications that would otherwise be protected.

Affected products

• PHP: 4.0.0, 4.0.1, 4.0.1-patch1, 4.0.1-patch2, 4.0.2, 4.0.3 (+42)

References

• http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522
• http://rhn.redhat.com/errata/RHSA-2006-0549.html
• http://secunia.com/advisories/17371
• http://secunia.com/advisories/17490
• http://secunia.com/advisories/17510
• http://secunia.com/advisories/17531
• http://secunia.com/advisories/17557
• http://secunia.com/advisories/17559
• http://secunia.com/advisories/18054
• http://secunia.com/advisories/18198
• http://secunia.com/advisories/18669
• http://secunia.com/advisories/21252

Get alerted when CVE-2005-3389 or the next vulnerability affects your stack