CVE-2017-9120

Vulnerability

CVE-2017-9120 is an integer overflow vulnerability in the mysqli_real_escape_string() function in PHP 7.x through 7.1.5 ([1], [2]). The overflow occurs when a very long string is passed to the function, leading to a buffer overflow that crashes the application. The affected versions include PHP 7.0.x and 7.1.x up to and including 7.1.5. The issue was reported in the PHP bug tracker as Bug #74544 [2] and has been fixed in later releases such as PHP 7.1.30 provided in Red Hat Software Collections [1].

Exploitation

An attacker can trigger the vulnerability remotely by providing a crafted long string as input to any application that uses mysqli_real_escape_string(). No special authentication or privileges are required if the application accepts user-supplied data. The attacker must be able to send data to the affected PHP endpoint, and the PHP script must call mysqli_real_escape_string() on that data. The exact string length needed to trigger the integer overflow is not specified, but the bug report [2] indicates that the problem is reproducible with a long string.

Impact

Successful exploitation results in a buffer overflow, causing a denial of service (application crash). The description also mentions the possibility of "unspecified other impact," but no code execution or information disclosure has been confirmed in the available references. The primary impact is a crash of the PHP process, which could lead to a denial of service for the affected web application or service.

Mitigation

The vulnerability was fixed in PHP 7.1.6 and later versions. Red Hat released a patched version rh-php71-php-7.1.30 as part of RHSA-2019:2519 [1]. Users should upgrade to a patched version of PHP (7.1.6 or later). For the Red Hat Software Collections version, the fix is included in rh-php71-php-7.1.30. If upgrading is not immediately possible, avoid using mysqli_real_escape_string() with untrusted long strings or use alternative escaping functions that do not have the overflow issue. No KEV listing was identified.