What’s Vulnerable › Vulnerabilities

CVE-2005-3390

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 65.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2005-11-01 · updated 2026-06-16

Description

The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.

Affected products

• PHP: 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 (+57)

References

• http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522
• http://rhn.redhat.com/errata/RHSA-2006-0549.html
• http://secunia.com/advisories/17371
• http://secunia.com/advisories/17490
• http://secunia.com/advisories/17510
• http://secunia.com/advisories/17531
• http://secunia.com/advisories/17557
• http://secunia.com/advisories/17559
• http://secunia.com/advisories/18054
• http://secunia.com/advisories/18198
• http://secunia.com/advisories/18669
• http://secunia.com/advisories/21252

Get alerted when CVE-2005-3390 or the next vulnerability affects your stack