cve/2024/CVE-2024-3096.md

CVE-2024-3096

Description

In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

POC

Reference

• http://www.openwall.com/lists/oss-security/2024/04/12/11
• http://www.openwall.com/lists/oss-security/2024/04/12/11
• https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr
• https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr

Github

• https://github.com/Symbolexe/SHIFU
• https://github.com/fkie-cad/nvd-json-data-feeds