SUPHP Design Flaw Local Privilege Escalation Weakness

Bugtraq ID:	11020
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 23 2004 12:00AM
Updated:	Aug 23 2004 12:00AM
Credit:	Discovery of this weakness is credited to Steven Van Acker <[email protected]>.
Vulnerable:	suPHP suPHP 0.5.2 suPHP suPHP 0.5.1 suPHP suPHP 0.5 suPHP suPHP 0.3.1 suPHP suPHP 0.3
Not Vulnerable:

SUPHP Design Flaw Local Privilege Escalation Weakness

suPHP is reported prone to a design flaw that may permit a user with some degree of local interactive access to a system to execute arbitrary PHP script code with the privileges of a targeted user.

The weakness occurs due to a lack of sufficient validation employed when performing access control checks prior to executing PHP contained in a target file.

If an attacker had the ability to write to a target file by exploiting another vulnerability, and the target file meets the suPHP security criteria, then the attacker may potentially execute arbitrary PHP script code in the context of the target user.

SUPHP Design Flaw Local Privilege Escalation Weakness

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

SUPHP Design Flaw Local Privilege Escalation Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

SUPHP Design Flaw Local Privilege Escalation Weakness

References:

• suPHP Homepage (suPHP)
  
• A word of caution on the use of suphp (Steven Van Acker )