Forum Discussion

Tom_Spector_50's avatar
Tom_Spector_50
Historic F5 Account
May 08, 2012

RE: Recent PHP-CGI query string parameter vulnerability

The recently found PHP-CGI query string parameter vulnerability noted in:   https://bugs.php.net/bug.php?id=61910v   Was announced on May 2nd and as of yet, does not have a solutio...
app sec
BIG-IP Access Policy Manager (APM)
security
kman_52500's avatar
kman_52500
Icon for Nimbostratus rankNimbostratus
May 22, 2012
If you are using php and CGI on URLs that don't end in .php this will not work.

 

 

i.e.

 

ScriptAlias /path /path/to/file.php

 

 

would still be vulnerable to

 

 

/path?-s