CVE-2015-6527

Vulnerability

The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x versions prior to 7.0.0 fails to validate the type of the third argument ($subject) passed to the str_ireplace function. When an attacker supplies a crafted non-string value, the internal function php_string_tolower can be invoked on an unexpected pointer, leading to memory corruption [2].

Exploitation

A remote attacker can call str_ireplace with a specially crafted value as the third argument, such as an integer or array, without needing authentication or user interaction beyond the normal PHP execution context. The lack of type checking allows the attacker to control assembly registers and trigger arbitrary code execution [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the target system. This can lead to full compromise of confidentiality, integrity, and availability of the application and server running the vulnerable PHP version.

Mitigation

The issue was fixed in PHP 7.0.0 and later versions. Users should upgrade to PHP 7.0.0 or newer. If upgrading is not possible, avoid using str_ireplace with untrusted input as the third argument. No workaround is provided [2].