Memory corruption

The arrayuserkeycompare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zvaldtor, which triggers memory corruption and allows local users to bypass safemode and execute arbitrary code via a certain unset operation after arrayuserkeycompare has been called...

CVE-2007-1484

The arrayuserkeycompare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zvaldtor, which triggers memory corruption and allows local users to bypass safemode and execute arbitrary code via a certain unset operation after arrayuserkeycompare has been called...

CVE-2007-1460

The zip:// URL wrapper provided by the PECL zip extension in PHP before 4.4.7, and 5.2.0 and 5.2.1, does not implement safemode or openbasedir checks, which allows remote attackers to read ZIP archives located outside of the intended directories...

cPanel <= 10.9.x (fantastico) Local File Inclusion Vulnerabilities

No description provided by source. Fantastico In all Version Cpanel 10.x = local File Include to the Note : Preparations php.ini in Cpanel hypothetical and They also in all WebServer Must provide username And pass and login :2082 To break the strongest protection modsecurity & safemode:On & Disab...

CVE-2007-1382

The PHP COM extensions for PHP on Windows systems allow context-dependent attackers to execute arbitrary code via a WScript.Shell COM object, as demonstrated by using the Run method of this object to execute cmd.exe, which bypasses PHP's safe mode...

Code injection

The PHP COM extensions for PHP on Windows systems allow context-dependent attackers to execute arbitrary code via a WScript.Shell COM object, as demonstrated by using the Run method of this object to execute cmd.exe, which bypasses PHP's safe mode...

CVE-2007-1382

The CVE-2007-1382 entry concerns the PHP COM extensions for PHP on Windows. The vulnerability arises when a context-dependent attacker uses a WScript.Shell COM object’s Run method to execute cmd.exe, bypassing PHP’s Safe Mode and enabling arbitrary code execution. The affected component is the PH...

CVE-2007-1370

Zend Platform 2.2.3 and earlier has incorrect ownership for scd.sh and certain other files, which allows local users to gain root privileges by modifying the files. NOTE: this only occurs when safemode and openbasedir are disabled; other settings require leverage for other vulnerabilities...

PHP COM Extensions - inconsistent Win32 safe_mode Bypass

PHP COM Extensions - inconsistent Win32 safemode Bypass Run'c:\windows\system32\cmd.exe /c '.escapeshellarg$GETcmd.' '.dirname$SERVERSCRIPTFILENAME.'/suntzoi.txt'; $suntzoi=file"suntzoi.txt"; for $i=0; $i milw0rm.com 2007-03-07...

PHP 'COM' Extensions - inconsistent Win32 'safe_mode' Bypass

Run'c:\windows\system32\cmd.exe /c '.escapeshellarg$GETcmd.' '.dirname$SERVERSCRIPTFILENAME.'/suntzoi.txt'; $suntzoi=file"suntzoi.txt"; for $i=0; $i milw0rm.com 2007-03-07...

PHP Ovrimos extension safe mode protection bypass

There are numerous code exectuion possibilities...

Zend Platform不安全文件访问权限漏洞

Zend Platform是企业级PHP应用的运行时平台环境。 Zend Platform的文件安装存在权限配置错误，本地攻击者可能利用此漏洞获取权限提升。 Zend Platform所安装的一些二进制程序和SHELL脚本没有设置安全的文件访问权限，导致Web服务器用户或安装Zend Platform的用户帐号错误地拥有了某些文件。如果入侵了Web服务器或安装Zend Platform的用户帐号的话，攻击者就可以通过替换或编辑文件获得权限提升，在下一次服务器重启时以root用户权限执行文件。 Zend Platform = 2.2.3 ----...

Mandrake Linux Security Advisory : php (MDKSA-2007:038)

PHP 5.2.0 and 4.4 allows local users to bypass safemode and openbasedir restrictions via a malicious path and a null byte before a ';' in a sessionsavepath argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.savepath...

CVE-2007-0905

PHP before 5.2.1 allows attackers to bypass safemode and openbasedir restrictions via unspecified vectors in the session extension. NOTE: it is possible that this issue is a duplicate of CVE-2006-6383...

[Full-disclosure] PHP 5.2.0 safe_mode bypass (by Writing Mode)

Source: http://securityreason.com/achievementsecurityalert/44 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PHP 5.2.0 safemode bypass by Writing Mode Author: Maksymilian Arciemowicz SecurityReason Date: - - Written: 02.12.2006 - - Public: 24.01.2007 SecurityAlert Id: 44 CVE: CVE-2007-0448...

PHP Safe Mod protection bypass

It's possible to traverse working directory protection by using writing mode srpath://../ file prefix for fopen...

PHP 5.2 - FOpen 'Safe_mode' Restriction Bypass

source: https://www.securityfocus.com/bid/22261/info PHP is prone to a 'safemode' restriction-bypass vulnerability. Successful exploits could allow an attacker to write files in unauthorized locations; other attacks may also be possible. This vulnerability would be an issue in shared-hosting...

CentOS 4 : PHP (CESA-2005:406)

Updated PHP packages that fix various security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A bug was found in the way PHP...

PHP-Update 2.7 - adminuploads.php Remote Code Execution

PHP-Update 2.7 - adminuploads.php Remote Code Execution !/usr/bin/perl rgod u fucking little piece of shit faggot. way to ruin a private exploit, scumbag use strict; use IO::Socket; use MIME::Base64; use Getopt::Std; my $app = "PHP-Update 2.7"; my $type = "Remote Code Execution"; my $author =...

PHP 5.2.0 session.save_path safe_mode and open_basedir bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PHP 5.2.0 session.savepath safemode and openbasedir bypass Author: Maksymilian Arciemowicz SecurityReason Date: - - Written: 02.10.2006 - - Public: 08.12.2006 SecurityAlert Id: 43 CVE: CVE-2006-6383 SecurityRisk: High Affected Software: PHP 5.2.0...