vendor:
PHP
by:
SecurityFocus
7.5
CVSS
HIGH
Restriction-Bypass
264
CWE
Product Name: PHP
Affected Version From: 5.2.2000
Affected Version To: 5.2.2000
Patch Exists: YES
Related CWE: N/A
CPE: a:php:php:5.2.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006
PHP ‘safe_mode’ and ‘open_basedir’ Restriction-Bypass Vulnerability
PHP is prone to a 'safe_mode' and 'open_basedir' restriction-bypass vulnerability. Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations. This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other. PHP version 5.2.0 is vulnerable to this issue.
Mitigation:
Ensure that the 'safe_mode' and 'open_basedir' restrictions are properly configured and enforced.
