CWE Code: 20
Vulnerability Type: sql_injection
CVSS Score: 6.8
CWE Name:  Improper Input Validation
Summary: php before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct sql injection attacks via a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c. as per: http://grokbase.com/t/php/php-internals/122ehfap93/about-cve-2012-0831-magic-quotes-gpc-remote-disable-vulnerability

version 5.3.10 and 5.3.11 are also vulnerable.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2012-02-10
Last Modified Date: 2018-01-18