PT-2007-1916 · Php · Php

Published 2007-05-24 · Updated 2008-09-11 · CVE-2007-0448

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP version 5.2.0

Description The issue concerns the fopen function, which does not properly handle invalid URI handlers. This allows attackers to bypass safe mode restrictions and read arbitrary files via a file path specified with an invalid URI.

Recommendations For PHP version 5.2.0, consider restricting the use of the fopen function with invalid URI handlers until a patch is available. As a temporary workaround, avoid using the fopen function with unvalidated input to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-0448

Affected Products

Php

References · 7

• 🔥 https://exploit-db.com/exploits/29528 · Exploit
• 🔥 http://securityreason.com/achievement_securityalert/44 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0448 · Security Note
• http://securityreason.com/securityalert/2175 · Note
• http://marc.info/?l=full-disclosure&m=116977186211191&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0448 · Note
• http://securityfocus.com/bid/22261 · Note