# php_snmp_error() Format String Vulnerability

php_snmp_error() passed snmp_errstr directly as a format string to zend_throw_exception_ex(), enabling format-string abuse and full code execution via the %Z zval specifier.

- Payout: $1,000
- Severity: high
- Program: Internet Bug Bounty
- Credited: rewzilla
- Disclosed: 2016-05-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/127212
- Library page: https://bugbountylibrary.com/r/h1%3A127212
- Tags: domain:oss impact:rce kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:memory-corruption vuln:rce

**Target:** ext/snmp/snmp.c php_snmp_error()
**Root cause:** snmp_object->snmp_errstr was passed directly to zend_throw_exception_ex() without a '%s' format specifier, so attacker-influenced error strings were interpreted as format strings.
**Steps:**
1. Trigger an SNMP error path in PHP so snmp_errstr is attacker-influenced
2. Craft the error string containing format specifiers such as `%Z` (zval) to manipulate the exception formatting
3. Leverage the %Z specifier to achieve code execution (PoC attached in original report)
**How found:** Code review of ext/snmp/snmp.c:533 spotted snmp_errstr passed to zend_throw_exception_ex() without a %s, then tested format specifiers including %Z to escalate to RCE.
**Exploitation:** Attacker-controlled SNMP error string is interpreted as a format string; abusing PHP's internal %Z zval specifier yields full code execution.
**Insight:** PHP's zend_throw_exception_ex and similar printf-family internals accept %Z (zval) specifiers; any user-influenced string reaching them without %s is a code-execution primitive, not just info leak.