PT-2008-4111 · Php+1 · Php+1

Published 2008-06-19 · Updated 2018-10-11 · CVE-2008-2666

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 5.2.6 and earlier

Description The issue allows context-dependent attackers to bypass safe mode restrictions. This can be achieved by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function.

Recommendations For PHP versions 5.2.6 and earlier, consider restricting access to the chdir and ftok functions as a temporary workaround until a patch is available. Additionally, avoid using ../ (dot dot slash) sequences in http URL arguments to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-2666

HPSBUX02431

HPSBUX02465

Affected Products

Hp-Ux

Php

References · 59

• 🔥 https://exploit-db.com/exploits/31937 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6203 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3658 · Security Note
• http://marc.info/?l=bugtraq&m=125631037611762&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3660 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3659 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2939 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2168 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5625 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-2666 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2665 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5624 · Security Note