CVE-2006-7243

PHP anterior a v5.3.4 acepta el caracter \0 en un nombre de ruta, lo que podría permitir a atacantes dependientes de contexto eludir las restricciones de acceso colocando una extensión de archivo después de este caracter, como se demuestra con .php\0.jpg al final del argumento de la función file_exists.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that PHP did not properly handle file names with a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. A flaw was found in PHP's SSL client's hostname identity check when handling certificates that contain hostnames with NULL bytes. If an attacker was able to get a carefully crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate to conduct man-in-the-middle attacks to spoof SSL servers.