PT-2003-1922 · Php · Php

Michal Krause · Published 2003-10-15 · Updated 2018-10-30 · CVE-2003-0863

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 4.3.x

Description The issue arises from the php check safe mode include dir function in fopen wrappers.c, which returns a success value when the safe mode include dir variable is not specified in the configuration. This behavior differs from the previous failure value and may allow remote attackers to exploit file include vulnerabilities in PHP applications.

Recommendations For PHP version 4.3.x, consider specifying the safe mode include dir variable in the configuration to prevent potential exploitation of file include vulnerabilities.

Exploit

Fix

Related Identifiers

CVE-2003-0863

Affected Products

Php

References · 4

• 🔥 https://exploit-db.com/exploits/22911 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-0863 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0863 · Note
• http://marc.info/?l=bugtraq&m=105839111204227 · Note