NULL Byte Poison Information Disclosure Vulnerability

[Anonymous]

Hi Guys I really need help.

I have no knowledge of PHP. I'm managing an IIS server that is going under PCI audit and this is one of the findings. Website is using PHP Manager 5.3 and WordPress.

I researched the issue and a page says add a code to fix

$file = str_replace(chr(0), '', $string);

I copied and paste this to any .PHP file that I could think of but honestly not sure if I copied to right file or right place inside the file. Can someone please help?

Where to put this code?



Also I saw another web page that was saying to add the same code but instead of $file was $input. so which one is correct ?



Thank you all in advance.

 

[Anonymous]

You can't just paste a piece of code in any file like that and expect it to work, that doesn't make sense.

The only advice I can give is: get someone who knows what they are doing to do it. The information that you have given is not enough to give you any other advice.