PHP security patch creates critical vulnerability

Credit: Myles Grant (Flickr)

The PHP Group released PHP 5.3.10 on Thursday in order to address a critical security flaw that can be exploited to execute arbitrary code on servers running an older version of the Web development platform.
The vulnerability is identified as CVE-2012-0830 and was discovered by Stefan Esser, an independent security consultant and creator of the popular Suhosin security extension for PHP.

SecurityFocus classifies the issue as a design error because it was accidentally introduced while fixing a separate denial-of-service (DoS) vulnerability in early January. It affects a number of Web development platforms including PHP, ASP.NET, Java and Python and can be exploited in a so-called hash collision attack. The PHP development team addressed CVE-2011-4885 in PHP 5.3.9, which was released on Jan. 10.

Source: 

 CSO Online

How To Find Vulnerabilities in PHP Applications - PHP Vulnerability Hunter

PHP Vulnerability Hunter is an advanced automated whitebox fuzz testing tool that can elicit a wide range of exploitable faults in PHP web applications. Since most of the webapplications now a days are on PHP, therefore PHP applications have been one of the major target of hackers, PHP Vulnerability scanner is the same tool that helped detect most of the web application vulnerabilities listed on the advisories page.




Like all the best tools in the world, this also needs little or no configuration at all, and doesn't require a user specified starting URI. So, you can begin scanning as soon as you download and install this software.

The tool itself runs on a pretty basic mechanism. At the core of the PHP Vulnerability Hunter scan algorithm is dynamic program analysis. It analyzes the program as it’s running to get a clear view of all input vectors ergo better code coverage leading to greater confidence in code security.

This new version brings to us many improvements such as:

• Added code coverage report
• Updated GUI validation
• Several instrumentation fixes
• Fixed lingering connection issue
• Fixed GUI and report viewer crashes related to working directory

And its key features include:

• Automated input vector discovery
• Integrate fault detection
• Minimal configuration
• Proven effective.

Download PHP Vulnerability v1.1.4.6