Secunia

rgod has discovered a weakness in PHP Designer 2005, which can be exploited by malicious people to hide the contents of certain source files.

The weakness is caused due to an error in the handling of NULL characters in text files. When a PHP file containing a NULL character is viewed in the editor, only the text that comes before the NULL character will be displayed. Any PHP script inserted after the NULL character will not be displayed in the editor, but will be run by the PHP interpreter.

Successful exploitation allows hiding e.g. malicious script code in a file when viewed using an affected editor.

The weakness has been confirmed in version 3.0.6. Other versions may also be affected.

Solution
Use another editor to cross-check the file contents.

Provided and/or discovered by
rgod

Original Advisory
http://rgod.altervista.org/syn.html

Deep Links
Links available in Customer Area