CVE-2004-1020

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magic_quotes_gpc mechanism. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915
http://www.gentoo.org/security/en/glsa/glsa-200412-14.xmlVendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2004:151
http://www.php.net/release_4_3_10.phpVendor Advisory
http://www.securityfocus.com/advisories/9028
http://www.securityfocus.com/archive/1/384663Exploit, Vendor Advisory
http://www.securityfocus.com/bid/11981Exploit, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/18516
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915
http://www.gentoo.org/security/en/glsa/glsa-200412-14.xmlVendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2004:151
http://www.php.net/release_4_3_10.phpVendor Advisory
http://www.securityfocus.com/advisories/9028
http://www.securityfocus.com/archive/1/384663Exploit, Vendor Advisory
http://www.securityfocus.com/bid/11981Exploit, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/18516

Timeline

Published: Jan 10, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-10217.5iCal before 1.5.4 on Mac OS X 10.2.3, and other later versions, does not alert the user when handling calendars that use alarms, which allow CVE-2004-10222.1Kerio Winroute Firewall before 6.0.7, ServerFirewall before 1.0.1, and MailServer before 6.0.5 use symmetric encryption for user passwords, CVE-2004-10232.1Kerio Winroute Firewall before 6.0.9, ServerFirewall before 1.0.1, and MailServer before 6.0.5, when installed on Windows based systems, do CVE-2004-102510.0Multiple heap-based buffer overflows in imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attacke CVE-2004-102610.0Multiple integer overflows in the image handler for imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow re CVE-2004-10275.0Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via CVE-2004-10287.2Untrusted execution path vulnerability in chcod on AIX IBM 5.1.0, 5.2.0, and 5.3.0 allows local users to execute arbitrary programs by modif CVE-2004-10299.3The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly rest CVE-2004-10302.1fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to gain sensitive information by calling fcronsighup wit CVE-2004-10317.2fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to bypass access restrictions and load an arbitrary conf CVE-2004-10322.1fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to delete arbitrary files or create arbitrary empty file CVE-2004-10332.1Fcron 2.0.1, 2.9.4, and possibly earlier versions leak file descriptors of open files, which allows local users to bypass access restriction