EUVD-2006-6366

Malware in sbrugna...

PHP <= 5.3.1 'session_save_path()' 'safe_mode' Restriction-Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/38182/info PHP is prone to a 'safemode' restriction-bypass vulnerability. Successful exploits could allow an attacker to write session files in arbitrary directions. This vulnerability would be an issue in shared-hosting...

PHP 'session_save_path()' 'safe_mode' Restriction-Bypass Vulnerability

Exploit for unknown platform in category remote exploits ====================================================================== PHP 'sessionsavepath' 'safemode' Restriction-Bypass Vulnerability ====================================================================== Vulnerable: PHP PHP 5.3.1 PHP PH...

PHP session_save_path()绕过safe_mode和open_basedir限制漏洞

BUGTRAQ ID: 38182 PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 用户可通过iniset和sessionsavepath函数来设置session.savepath。在 session.savepath中应存在一个用户保存用户tmp文件的路径，但session.savepath的句法为： /PATH 或 N;/PATH N可以为字符串（应为数字） 例如： 1. sessionsavepath"/DIR/WHERE/YOU/HAVE/ACCESS" 2. sessionsavepath"5;/DIR/WHERE/YOU/HAVE/ACCESS...

PHP 5.3.1 - &#039;session_save_path() Safe_mode()&#039; Restriction Bypass Exploiot

source: https://www.securityfocus.com/bid/38182/info PHP is prone to a 'safemode' restriction-bypass vulnerability. Successful exploits could allow an attacker to write session files in arbitrary directions. This vulnerability would be an issue in shared-hosting configurations where multiple user...

PHP safe mode protection bypass with htaccess

It's possible to manipulate function iniset and sessionsavepath with htaccess settings...

CVE-2006-6383

CVE-2006-6383 affects PHP 5.2.0 and 4.4. It allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, causing PHP to validate the allowed path but set session.save_path to th...

CVE-2006-6383

PHP 5.2.0 and 4.4 allows local users to bypass safemode and openbasedir restrictions via a malicious path and a null byte before a ";" in a sessionsavepath argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.savepath...

PHP safe_mode and open_basedir protection bypass

It's possible to access directories above basedir with sessionsavepath...