PHP Win32STD Extension Safe_Mode and Disable_Functions Restriction Bypass Vulnerability

Bugtraq ID:	25041
Class:	Design Error
CVE:	CVE-2007-4010
Remote:	No
Local:	Yes
Published:	Jul 24 2007 12:00AM
Updated:	May 07 2015 05:36PM
Credit:	Shinnai is credited with discovering this issue.
Vulnerable:	PHP PHP 5.2.3
Not Vulnerable:

PHP Win32STD Extension Safe_Mode and Disable_Functions Restriction Bypass Vulnerability

PHP is prone to a 'safe_mode' and 'disable_functions' restriction-bypass vulnerability. Successful exploits could allow an attacker to bypasss the restrictions imposed by both PHP directives and execute PHP code containing a restricted function.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.

PHP 5.2.3 is reported vulnerable; other versions may also be affected.

PHP Win32STD Extension Safe_Mode and Disable_Functions Restriction Bypass Vulnerability

Attackers may exploit this issue by crafting and executing a malicious PHP script.

The following proof of concept is available:

• /data/vulnerabilities/exploits/25041.php

PHP Win32STD Extension Safe_Mode and Disable_Functions Restriction Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHP Win32STD Extension Safe_Mode and Disable_Functions Restriction Bypass Vulnerability

References:

• PHP Homepage (PHP)