CVE-2007-1710

2007-03-2701:19:00

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:P/I:P/A:P

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

32.1%

JSON

The readfile function in PHP 4.4.4, 5.1.6, and 5.2.1 allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files by referring to local files with a certain URL syntax instead of a pathname syntax, as demonstrated by a filename preceded a “php://…/…/” sequence.

Affected configurations

Nvd

Node

phpphpMatch4.4.4

phpphpMatch5.1.6

phpphpMatch5.2.1

VendorProductVersionCPE
phpphp4.4.4cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*
phpphp5.1.6cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*
phpphp5.2.1cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*