470 matches found
CVE-2010-1130
session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; semicolon characters in the argument to the sessionsavepath function, which allows context-dependent attackers to bypass openbasedir and safemode restrictions via an argument that contains multiple ;...
CVE-2010-1130
session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; semicolon characters in the argument to the sessionsavepath function, which allows context-dependent attackers to bypass openbasedir and safemode restrictions via an argument that contains multiple ;...
CVE-2010-1130
CVE-2010-1130 affects PHP’s session extension: in session.c, PHP versions before 5.2.13 and 5.3.1 fail to interpret semicolon characters properly in the session_save_path argument, enabling a context-dependent attacker to bypass open_basedir and safe_mode restrictions through an argument containi...
CVE-2010-1130: Undefined Security Weakness
session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; semicolon characters in the argument to the sessionsavepath function, which allows context-dependent attackers to bypass openbasedir and safemode restrictions via an argument that contains multiple ;...
CVE-2010-1130
session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; semicolon characters in the argument to the sessionsavepath function, which allows context-dependent attackers to bypass openbasedir and safemode restrictions via an argument that contains multiple ;...
Mandriva Update for php MDVSA-2010:058 (php)
Check for the Version of php OpenVAS Vulnerability Test Mandriva Update for php MDVSA-2010:058 php Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms ...
PHP session_save_path()绕过safe_mode和open_basedir限制漏洞
BUGTRAQ ID: 38182 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 用户可通过iniset和sessionsavepath函数来设置session.savepath。在 session.savepath中应存在一个用户保存用户tmp文件的路径，但session.savepath的句法为： /PATH 或 N;/PATH N可以为字符串（应为数字） 例如： 1. sessionsavepath"/DIR/WHERE/YOU/HAVE/ACCESS" 2. sessionsavepath"5;/DIR/WHERE/YOU/HAVE/ACCESS...
PHP < 5.3.2 / 5.2.13 Multiple Vulnerabilities
According to its banner, the version of PHP installed on the remote host is older than 5.3.2 / 5.2.13. Such versions may be affected by several security issues : - Directory paths not ending with '/' may not be correctly validated inside 'tempnam' in 'safemode' configuration. - It may be possible...
PHP 5.2.12 / 5.3.1 safe_mode / open_basedir Bypass
PHP 5.2.12/5.3.1 session.savepath safemode and openbasedir bypass Credit: Grzegorz Stachowiak Provided by: SecurityReason.com Date: - Written: 31.01.2010 - Public: 11.02.2010 SecurityRisk: Medium Affected Software: PHP 5.2.12 PHP 5.3.1 Advisory URL:...
PHP 5.2.11/5.3.0 multiple vulnerabilities-vulnerability warning-the black bar safety net
? php / PHP 5.2.11/5.3.0 symlink openbasedir bypass by Maksymilian Arciemowicz cxib a. T securityreason d0t com CHUJWAMWMUZG / $fakedir="cx"; $fakedep=1 6; $num=0; // offset of symlink.$ num if! empty$GET'file' $file=$GET'file'; else if! empty$POST'file' $file=$POST'file'; else $file=""; echo...
PHP multiple security vulnerabilities
safemode bypass, openbasedir bypass, memory corruption...
PHP 5.2.12 / 5.3.1 symlink() open_basedir Bypass
This is exploit from Security Audit Lab - SecurityReason labs. Author : Maksymilian Arciemowicz Script for legal use only. PHP 5.2.12 5.3.1 symlink openbasedir bypass More: SecurityReason '; ifempty$file exit; if!iswritable"." die"not writable directory"; $level=0; for$as=0;$as$fakedep;$as++...
PHP posix_mkfifo()函数绕过open_basedir安全限制漏洞
BUGTRAQ ID: 36554 CVECAN ID: CVE-2009-3558 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的posixmkfifo函数中的错误可能允许绕过openbasedir限制。以下是ext/posix/posix.c文件中的有漏洞代码段： PHPFUNCTIONposixmkfifo char path; int pathlen; long mode; int result; if zendparseparametersZENDNUMARGS TSRMLSCC, "sl", &path, &pathlen, &mod...
PHP 5.2.125.3.1 - symlink() open_basedir Bypass
PHP 5.2.125.3.1 - symlink openbasedir Bypass This is exploit from Security Audit Lab - SecurityReason labs. Author : Maksymilian Arciemowicz Script for legal use only. PHP 5.2.12 5.3.1 symlink openbasedir bypass More: SecurityReason '; ifempty$file exit; if!iswritable"." die"not writable...
PHP 5.2.12/5.3.1 symlink() open_basedir bypass
No description provided by source. ?php / PHP 5.2.12/5.3.1 symlink openbasedir bypass by Maksymilian Arciemowicz http://securityreason.com/ cxib a.T securityreason d0t com CHUJWAMWMUZG / $fakedir="cx"; $fakedep=16; $num=0; // offset of symlink.$num if!empty$GET'file' $file=$GET'file'; else...
PHP 5.2.12/5.3.1 symlink() open_basedir bypass
Exploit for unknown platform in category local exploits ============================================== PHP 5.2.12/5.3.1 symlink openbasedir bypass ============================================== Title: PHP 5.2.12/5.3.1 symlink openbasedir bypass CVE-ID: OSVDB-ID: Author: Maksymilian Arciemowicz...
PHP 5.2.12/5.3.1 - 'symlink()' open_basedir Bypass
This is exploit from Security Audit Lab - SecurityReason labs. Author : Maksymilian Arciemowicz Script for legal use only. PHP 5.2.12 5.3.1 symlink openbasedir bypass More: SecurityReason '; ifempty$file exit; if!iswritable"." die"not writable directory"; $level=0; for$as=0;$as$fakedep;$as++...
FreeBSD : php -- multiple vulnerabilities (39a25a63-eb5c-11de-b650-00215c6a37bb)
PHP developers reports : This release focuses on improving the stability of the PHP 5.2.x branch with over 60 bug fixes, some of which are security related. All users of PHP 5.2 are encouraged to upgrade to this release. Security Enhancements and Fixes in PHP 5.2.12 : - Fixed a safemode bypass in...
PHP < 5.2.12 Multiple Vulnerabilities
According to its banner, the version of PHP installed on the remote host is older than 5.2.12. Such versions may be affected by several security issues : - It is possible to bypass the 'safemode' configuration setting using 'tempnam'. CVE-2009-3557 - It is possible to bypass the 'openbasedir'...