PHP cURL safe_mode和open_basedir绕过安全限制漏洞

BUGTRAQ ID: 34475 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP支持libcurl库，用户可以使用各种类型的协议连接到不同类型的服务器。curl函数在检查safemode和openbasedir限制时存在漏洞，可能允许用户绕过安全限制执行非授权操作。例如对于以下代码： curlsetopt$ch, CURLOPTURL, "file:file:////etc/passwd"; curl首先对以下内容检查safemode和openbasedir： "file:////etc/passwd" 接下来读取：...

PHP 5.2.9 cURL - 'Safe_mode' / 'open_basedir' Restriction Bypass

source: https://www.securityfocus.com/bid/34475/info PHP is prone to a 'safemode' and 'openbasedir' restriction-bypass vulnerability. Successful exploits could allow an attacker to access files in unauthorized locations. This vulnerability would be an issue in shared-hosting configurations where...

Mandriva Update for php MDKSA-2007:038 (php)

Check for the Version of php OpenVAS Vulnerability Test Mandriva Update for php MDKSA-2007:038 php Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms ...

Mandrake Security Advisory MDVSA-2009:065 (php4)

The remote host is missing an update to php4 announced via advisory MDVSA-2009:065. OpenVAS Vulnerability Test $Id: mdksa2009065.nasl 6587 2017-07-07 06:35:35Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:065 php4 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

PHP python module safe_mode bypass

Module doesn't check safemode restrictions for python code...

php python extension safe_mode bypass

?php / phppythonbypass.php php python extension safemode bypass Amir Salmani - amiratsalmanidotir / //python ext. installed? if !extensionloaded'python' die"python extension is not installedn"; //eval python code $res = pythoneval' import os pwd = os.getcwd print pwd os.system'cat /etc/passwd' ';...

PHP python extension safe_mode Bypass Local Vulnerability

No description provided by source. ?php / phppythonbypass.php php python extension safemode bypass Amir Salmani - amiratsalmanidotir / //python ext. installed? if !extensionloaded'python' die"python extension is not installed\n"; //eval python code $res = pythoneval' import os pwd = os.getcwd pri...

CVE-2008-5625

PHP 5 before 5.2.7 does not enforce the errorlog safemode restrictions when safemode is enabled through a phpadminflag setting in httpd.conf, which allows context-dependent attackers to write to arbitrary files by placing a "phpvalue errorlog" entry in a .htaccess file...

Unrestricted file upload

PHP 5 before 5.2.7 does not enforce the errorlog safemode restrictions when safemode is enabled through a phpadminflag setting in httpd.conf, which allows context-dependent attackers to write to arbitrary files by placing a "phpvalue errorlog" entry in a .htaccess file...

CVE-2008-5625

PHP 5 before 5.2.7 does not enforce the errorlog safemode restrictions when safemode is enabled through a phpadminflag setting in httpd.conf, which allows context-dependent attackers to write to arbitrary files by placing a "phpvalue errorlog" entry in a .htaccess file...

CVE-2008-5624

CVE-2008-5624 affects PHP 5 before 5.2.7 where page_uid/page_gid globals were not properly initialized for php_getuid, enabling context-dependent attackers to bypass safe_mode via error_log settings. The public record in the initial description confirms the vulnerability and its impact on permiss...

CVE-2008-5625

PHP 5 before 5.2.7 is affected by CVE-2008-5625: when safe_mode is enabled via php_admin_flag in httpd.conf, error_log restrictions are not enforced, allowing context-dependent attackers to write to arbitrary files by placing a php_value error_log entry in .htaccess. The vulnerability arises from...

CVE-2008-5624

PHP 5 before 5.2.7 does not properly initialize the pageuid and pagegid global variables for use by the SAPI phpgetuid function, which allows context-dependent attackers to bypass safemode restrictions via variable settings that are intended to be restricted to root, as demonstrated by a setting ...

PHP 5 'posix_access()'功安全模式绕过目录遍历漏洞

CVE-2008-2665 PHP is prone to a directory-traversal vulnerability because it fails to adequately sanitize user-supplied data. Attackers can leverage this issue to bypass security restrictions enforced by 'safemode' to access data outside of the root webserver directory. Successful attacks may all...

PHP - Safe_mode Bypass via proc_open() and custom Environment

PHP - Safemode Bypass via procopen and custom Environment ----------------------------------------------------------------------- + safe-bypass-procopen.txt - yet another way to bypass PHP safemode. + + By Milen Rangelov + ----------------------------------------------------------------------- Th...

PHP safe_mode can be bypassed via proc_open() and custom environment.

This should work provided that you have met the following requirements: 1 A writable directory under documentroot to place those files obviously 2 You don't have procopen in your disabledfunctions list 3 You are able to compile a shared library on the same platform as the target web server. Here ...

PHP 5 < 5.2.7 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is prior to 5.2.7. It is, therefore, affected by multiple vulnerabilities : - There is a buffer overflow flaw in the bundled PCRE library that allows a denial of service attack. CVE-2008-2371 - Multiple directory traversal...

PHP 5.2.6 (error_log) safe_mode Bypass Vulnerability-vulnerability warning-the black bar safety net

SecurityReason.com PHP 5.2.6 errorlog safemode bypass Author: Maksymilian Arciemowicz cXIb8O3 securityreason.com Date: - - Written: 10.11.2008 - - Public: 20.11.2008 SecurityReason Research SecurityAlert Id: 5 7 CWE: CWE-2 6 4 SecurityRisk: Medium Affected Software: PHP 5.2.6 Advisory URL:...

SecurityReason : PHP 5.2.6 &#40;error_log&#41; safe_mode bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SecurityReason.com PHP 5.2.6 errorlog safemode bypass Author: Maksymilian Arciemowicz cXIb8O3 securityreason.com Date: - - Written: 10.11.2008 - - Public: 20.11.2008 SecurityReason Research SecurityAlert Id: 57 CWE: CWE-264 SecurityRisk: Medium Affect...

PHP 5.2.6 (error_log) safe_mode Bypass Vulnerability

No description provided by source. SecurityReason.com PHP 5.2.6 errorlog safemode bypass Author: Maksymilian Arciemowicz cXIb8O3 securityreason.com Date: - - Written: 10.11.2008 - - Public: 20.11.2008 SecurityReason Research SecurityAlert Id: 57 CWE: CWE-264 SecurityRisk: Medium Affected Software...