CVE-2001-1247

CVE-2001-1247 affects PHP 4.0.4pl1 and 4.0.5 in safe mode, enabling remote attackers to read and write files owned by the web server UID by uploading a PHP script that uses error_log to access files. Impact: partial confidentiality and integrity exposure via uploaded scripts. Remediation: upgrade...

CVE-2001-1246

CVE-2001-1246 affects PHP versions 4.0.5–4.1.0 running in safe mode. The fifth parameter to mail() is not properly sanitized, enabling local users and possibly remote attackers to execute arbitrary commands via shell metacharacters. Multiple connected documents (NVD/Nessus advisories) describe th...