265 matches found
PHP realpath()函数绕过safe_mode及open_basedir安全限制漏洞
PHP是一种流行的WEB服务器端编程语言。 PHP的realpath函数实现上存在漏洞，远程攻击者可能利用此漏洞绕过某些安全限制。 PHP的fileexists函数不允许检查是否存在openbasedir指定目录之外的文件，但readfile没有这个限制，允许检查文件系统的任意位置是否存在某一文件。如果realpath$filename返回了字符串（也就是非false），就表示文件存在，这就导致绕过了openbasedir限制。 PHP PHP 5.2.3 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.php.net/downloads.php...
CVE-2007-0448
The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safemode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI...
CVE-2007-0448
The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safemode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI...
CVE-2007-0448
The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safemode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI...
CVE-2007-0448
CVE-2007-0448 : The PHP 5.2.0 fopen implementation fails to properly handle invalid URI handlers, enabling context-dependent attackers to bypass safe_mode and read arbitrary files via a path specified with an invalid URI (illustrated by the srpath URI). This is documented across multiple sources ...
php -- multiple vulnerabilities
The PHP development team reports: Security Enhancements and Fixes in PHP 5.2.2 and PHP 4.4.7: Fixed CVE-2007-1001, GD wbmp used with invalid image size Fixed asciiz byte truncation inside mail Fixed a bug in mbparsestr that can be used to activate registerglobals Fixed unallocated memory...
PHP < 4.4.5 Multiple Vulnerabilities
According to its banner, the version of PHP installed on the remote host is older than 4.4.5. Such versions may be affected by several issues, including buffer overflows, format string vulnerabilities, arbitrary code execution, 'safemode' and 'openbasedir' bypasses, and clobbering of super-global...
PHP 5.2.1 - Session.Save_Path() TMPDIR open_basedir Restriction Bypass
PHP 5.2.1 - Session.SavePath TMPDIR openbasedir Restriction Bypass source: https://www.securityfocus.com/bid/23183/info PHP is prone to a 'openbasedir' restriction-bypass vulnerability due to a design error. Successful exploits could allow an attacker to access sensitive information or to write...
CVE-2007-1484
The arrayuserkeycompare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zvaldtor, which triggers memory corruption and allows local users to bypass safemode and execute arbitrary code via a certain unset operation after arrayuserkeycompare has been called...
fantastico-lfi.txt
Fantastico In all Version Cpanel 10.x = local File Include to the Note : Preparations php.ini in Cpanel hypothetical and They also in all WebServer Must provide username And pass and login :2082 To break the strongest protection modsecurity & safemode:On & Disable functions : All NONE Vulnerable...
Fantastico In all Version Cpanel 10.x <= local File Include
Fantastico In all Version Cpanel 10.x = local File Include to the Note : Preparations php.ini in Cpanel hypothetical and They also in all WebServer Must provide username And pass and login :2082 To break the strongest protection modsecurity & safemode:On & Disable functions : All NONE Vulnerable...
cPanel 10.9.x - Fantastico Local File Inclusion
cPanel 10.9.x - Fantastico Local File Inclusion Fantastico In all Version Cpanel 10.x = local File Include to the Note : Preparations php.ini in Cpanel hypothetical and They also in all WebServer Must provide username And pass and login :2082 To break the strongest protection modsecurity &...
cPanel <= 10.9.x (fantastico) Local File Inclusion Vulnerabilities
Exploit for unknown platform in category web applications ================================================================== cPanel = 10.9.x fantastico Local File Inclusion Vulnerabilities ================================================================== Fantastico In all Version Cpanel 10.x =...
cPanel 10.9.x - 'Fantastico' Local File Inclusion
Fantastico In all Version Cpanel 10.x = local File Include to the Note : Preparations php.ini in Cpanel hypothetical and They also in all WebServer Must provide username And pass and login :2082 To break the strongest protection modsecurity & safemode:On & Disable functions : All NONE Vulnerable...
PHP COM extension safe_mode protection bypass
WScript.Shell COM object allows execution of any commands...
Buffer overflow
Zend Platform 2.2.3 and earlier has incorrect ownership for scd.sh and certain other files, which allows local users to gain root privileges by modifying the files. NOTE: this only occurs when safemode and openbasedir are disabled; other settings require leverage for other vulnerabilities...
CVE-2007-1370
CVE-2007-1370 affects Zend Platform 2.2.3 and earlier, where incorrect file ownership (notably for scd.sh and related files) permits local users to gain root privileges by modifying those files. The issue occurs when safe_mode and open_basedir are disabled; other configurations may require differ...
CVE-2007-1370
Zend Platform 2.2.3 and earlier has incorrect ownership for scd.sh and certain other files, which allows local users to gain root privileges by modifying the files. NOTE: this only occurs when safemode and openbasedir are disabled; other settings require leverage for other vulnerabilities...
php_446_mssql_connect_bof.txt
original url: http://retrogod.altervista.org/php446mssqlconnectbof.html...
PHP COM extensions (inconsistent Win32) safe_mode Bypass Exploit
No description provided by source. ?php //PHP COM extensions inconsistent Win32 safemode bypass //by rgod $suntzu = new COM"WScript.Shell"; $suntzu-Run'c:windowssystem32cmd.exe /c '.escapeshellarg$GETcmd.' '.dirname$SERVERSCRIPTFILENAME.'/suntzoi.txt';...