CVE-2020-7059

OOB read in php_strip_tags_ex

When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.

We have discovered 245,422 live websites that are affected by CVE-2020-7059.

Run a Free Instant Scan



Affected Software

Product  PHP
Category Programming Languages
Vulnerable Domains245,422 live websites (3.64% of PHP install base)
Vulnerable Versions
  • from 7.2 through 7.2.27
  • from 7.3 through 7.3.14
  • from 7.4 through 7.4.2
Vulnerable Versions Count43 versions ( 8.07% of all versions)


Common Weakness Enumeration

CWE-125 Out-of-bounds Read



Details

  • Published - Feb 10, 2020
  • Updated - Sep 17, 2024

Credits

  • Reported by wxhusst at gmail dot com

Website Distribution by Country

Number of websites using CVE-2020-7059
United States83,644 websites


France100,272 websites
China7,422 websites
Russia6,626 websites
Germany4,752 websites
Poland4,270 websites
Netherlands4,129 websites
Italy3,300 websites
GB3,011 websites
Japan2,991 websites

Website Distribution by TLD

Number of websites using CVE-2020-7059
.com74,720 websites
.ru66,480 websites
.fr40,834 websites
.org6,687 websites
.net5,719 websites
.be5,070 websites
.pl4,083 websites
.it3,253 websites
.nl3,025 websites
.de2,589 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2020-7059

Top websites that are affected by CVE-2020-7059. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*.cn China*,***
*********.com China*,***
******.com China*,***
******.com France*,***
***.****.gov United States*,***
*****.**.com China*,***
*****.org United States*,***
*******.info France*,***
*********.com United States*,***
******.com France*,***
See full domain list

FAQ

CVE-2020-7059 is Out-of-bounds Read in PHP
A total of 245,422 websites have been identified as vulnerable to CVE-2020-7059, based on global website indexing conducted by WebTechSurvey.
The PHP is affected by the CVE-2020-7059 vulnerability.
PHP versions up to 7.4.2 are vulnerable to CVE-2020-7059.
CVE-2020-7059 is resolved in version 7.4.2 of PHP.