PT-2008-4110 · Php+1 · Php+1
Publicado
2008-06-19
·
Atualizado
2018-10-11
·
CVE-2008-2665
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PHP versions 5.2.6 and earlier
Description
A directory traversal issue exists in the posix access function, allowing remote attackers to bypass safe mode restrictions. This is achieved by including a .. (dot dot) in an HTTP URL, which results in the URL being canonicalized to a local filename after the safe mode check has successfully run.
Recommendations
For PHP versions 5.2.6 and earlier, consider updating to a newer version to mitigate the risk, as the issue is resolved in later versions. As a temporary workaround, consider restricting access to sensitive directories and files to minimize the risk of exploitation.
Exploit
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Hp-Ux
Php