Weakness (CWE)
CWE-616: Incomplete Identification of Uploaded File Variables (PHP)
Variant Incomplete
The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type).
How to prevent it (3 mitigations)
-
Architecture and Design
Use PHP 4 or later.
-
Architecture and Design
If you must support older PHP versions, write your own version of is_uploaded_file() and run it against $HTTP_POST_FILES['userfile']))
-
Implementation
For later PHP versions, reference uploaded files using the $HTTP_POST_FILES or $_FILES variables, and use is_uploaded_file() or move_uploaded_file() to ensure that you are dealing with an uploaded file.
Source: MITRE CWE-616
3 results · Clear filters · Feed
-
Critical 9.9
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files in…
-
Critical 9.8
An issue in Beijing Panabit Network Software Co., Ltd Panalog big data analysis platform v. 20240323 and before allows …
-
Critical 9.8
In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid …