VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 1, 2005· Updated Jun 16, 2026

CVE-2005-3390

CVE-2005-3390

Description

The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

66
  • PHP/PHP64 versions
    cpe:2.3:a:php:php:3.0:*:*:*:*:*:*:*+ 63 more
    • cpe:2.3:a:php:php:3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.15:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.16:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.17:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.18:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:3.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.1:patch1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.1:patch2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.3:patch1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.7:rc1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.7:rc2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.0.7:rc3:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.2:*:dev:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:4.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:php:php:5.0:rc3:*:*:*:*:*:*
    • (no CPE)range: <=4.4.0, <=5.0.5
  • osv-coords2 versions
    pkg:rpm/opensuse/php7&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweed
    < 7.4.24-1.1+ 1 more
    • (no CPE)range: < 7.4.24-1.1
    • (no CPE)range: < 8.0.11-1.1

Patches

Vulnerability mechanics

Root cause

"The RFC1867 file upload feature in PHP mishandles multipart/form-data POST requests when register_globals is enabled, allowing manipulation of the GLOBALS array."

Attack vector

An attacker can send a crafted multipart/form-data POST request to a PHP application where `register_globals` is enabled. This request should include a file upload field named 'GLOBALS'. By exploiting the RFC1867 file upload mechanism, the attacker can overwrite the GLOBALS array, potentially bypassing security protections and executing arbitrary commands [ref_id=1].

Affected code

The vulnerability lies within the RFC1867 file upload handling in PHP versions prior to 4.4.1 and 5.0.6. Specifically, the `register_globals` feature interacts insecurely with multipart/form-data requests, allowing the 'GLOBALS' variable to be overwritten. The provided exploit targets the `e107_handlers/tiny_mce/plugins/ibrowser/ibrowser.php` file, which includes vulnerable code related to global variable handling [ref_id=1].

What the fix does

The advisory does not specify a patch or provide details on how the vulnerability was fixed. However, the vulnerability is mitigated by disabling the `register_globals` directive in PHP's configuration. This prevents user-supplied data from automatically populating global variables, thus blocking the attack vector.

Preconditions

  • configThe `register_globals` PHP configuration directive must be enabled.
  • inputThe target application must utilize the RFC1867 file upload feature.

Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

33

News mentions

0

No linked articles in our index yet.