Re: Re: [Full-disclosure] PHP import_request_variables()
[/quote]
I can see why you weren't able to find anything. However, there have
been a number of disclosures that are probably related - but these
were grep-and-gripe affairs in third party applications, where the
researcher didn't necessarily investigate *why* certain attacks
worked.
[/quote]
let me say this: some of this entries are about vulnerabilities
I discovered. Most of them are about a *misuse* of extract(),
if specified with the EXTR_OVERWRITE flag or without flag (it's the same).
Also EXTR_SKIP flag exists.
So I considered a risky feature that some programmers misunderstood.
Also php manual clearly says about the *security hazard*. *And*
theese issues are very known to php exploiters for years, after
Mr. Esser pointed attention to that.
Now I go back to my grep 'n gripe affairs
Andrea 'rgod' Micalizzi