PT-2008-6678 · Php+1 · Php+1
Cxib8O3
+1
·
Publicado
2008-12-17
·
Atualizado
2018-10-11
·
CVE-2008-5625
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.2.7
Description
The issue allows context-dependent attackers to write to arbitrary files. This is possible because PHP does not enforce the error log safe mode restrictions when safe mode is enabled through a php admin flag setting in httpd.conf. An attacker can exploit this by placing a "php value error log" entry in a .htaccess file.
Recommendations
For PHP versions prior to 5.2.7, update to version 5.2.7 or later to resolve the issue. As a temporary workaround, consider disabling the use of .htaccess files to minimize the risk of exploitation. Restrict access to the error log setting in php admin flag to prevent unauthorized modifications.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Hp-Ux
Php