CVE-2016-6175 in php-gettext
Summary
by MITRE
Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/01/2025
The CVE-2016-6175 vulnerability represents a critical server-side code injection flaw in the php-gettext library version 1.0.12 and earlier. This vulnerability specifically targets the plural forms header processing functionality within the gettext internationalization system, which is commonly used in web applications to support multiple languages. The flaw exists in how the library handles the plural forms header parameter, which is part of the standard gettext translation format used to determine how to pluralize words in different languages. When an attacker crafts a malicious plural forms header containing PHP code, the vulnerable library executes this code as part of its normal processing routine, creating a remote code execution vector that can be exploited by unauthorized users.
The technical implementation of this vulnerability stems from improper input validation and sanitization within the php-gettext library's parsing mechanism. The library accepts user-supplied data from translation files without adequate sanitization, particularly in the plural forms header field. This field is designed to contain a formula that determines how to handle plural forms in different languages, but attackers can inject malicious PHP code within this parameter. The vulnerability is classified under CWE-94, which represents "Improper Control of Generation of Code ('Code Injection')" and specifically relates to situations where user-controllable data is executed as code without proper validation. The attack vector is remote and requires no authentication, making it particularly dangerous as it can be exploited by anyone who can influence the translation files or access the vulnerable application's translation processing functionality.
The operational impact of CVE-2016-6175 is severe and multifaceted, affecting any web application that utilizes the vulnerable php-gettext library for internationalization purposes. Successful exploitation allows attackers to execute arbitrary PHP code on the target server with the privileges of the web application, potentially leading to complete system compromise. Attackers can use this vulnerability to gain unauthorized access to sensitive data, install backdoors, modify application behavior, or launch further attacks against internal network resources. The vulnerability affects applications that process translation files containing malicious plural forms headers, which could be introduced through various means including compromised translation repositories, malicious user uploads, or supply chain attacks. According to ATT&CK framework, this vulnerability maps to T1059.007 for "Command and Scripting Interpreter: PHP" and T1190 for "Exploit Public-Facing Application," demonstrating how the flaw can be leveraged for both code execution and initial access within a target environment.
Organizations affected by this vulnerability should immediately implement comprehensive mitigation strategies to protect their systems. The primary and most effective mitigation is to upgrade to php-gettext version 1.0.13 or later, which contains the necessary patches to address the code injection vulnerability. Additionally, administrators should implement strict input validation and sanitization measures for all translation files, particularly those that may be user-generated or sourced from external repositories. Network segmentation and access controls should be enforced to limit exposure of applications using vulnerable libraries. Security monitoring should be enhanced to detect unusual code execution patterns or attempts to access translation processing endpoints. Organizations should also conduct thorough vulnerability assessments to identify all applications using the affected library and ensure proper patch management procedures are in place to prevent similar issues from occurring in the future. The vulnerability highlights the importance of regularly updating third-party libraries and maintaining comprehensive inventory of all software components used in web applications.