PT-2007-1916 · Php · Php

Publicado 2007-05-24 · Atualizado 2008-09-11 · CVE-2007-0448

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP version 5.2.0

Description The issue concerns the fopen function, which does not properly handle invalid URI handlers. This allows attackers to bypass safe mode restrictions and read arbitrary files via a file path specified with an invalid URI.

Recommendations For PHP version 5.2.0, consider restricting the use of the fopen function with invalid URI handlers until a patch is available. As a temporary workaround, avoid using the fopen function with unvalidated input to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-0448

Produtos afetados

Php

Referências · 7

• 🔥 https://exploit-db.com/exploits/29528 · Exploit
• 🔥 http://securityreason.com/achievement_securityalert/44 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0448 · Nota de Segurança
• http://securityreason.com/securityalert/2175 · Nota
• http://marc.info/?l=full-disclosure&m=116977186211191&w=2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0448 · Nota
• http://securityfocus.com/bid/22261 · Nota