CVE-2007-1359
CVE-2007-1359
Interpretation conflict in ModSecurity (mod_security) 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ (0x00) byte, which mod_security treats as a terminator even though it is still processed as normal data by some HTTP parsers including PHP 5.2.0, and possibly parsers in Perl, and Python.
Affected products
n/a · n/apublic PoCs found — 1
exploitdbwww.exploit-db.com/exploits/3425unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143http://secunia.com/advisories/24373http://secunia.com/advisories/25316http://secunia.com/advisories/31087http://secunia.com/advisories/31113https://exchange.xforce.ibmcloud.com/vulnerabilities/32872http://www.gentoo.org/security/en/glsa/glsa-200705-17.xmlhttp://www.modsecurity.org/blog/archives/2007/03/modsecurity_asc.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2008-090335.htmlhttp://www.osvdb.org/32778http://www.php-security.org/MOPB/BONUS-12-2007.htmlhttp://www.securityfocus.com/bid/22831