PHP Include File Relative Directory Information Disclosure Vulnerability
BID:4063
Info
PHP Include File Relative Directory Information Disclosure Vulnerability
| Bugtraq ID: | 4063 |
| Class: | Configuration Error |
| CVE: |
CVE-2002-0253 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 08 2002 12:00AM |
| Updated: | Jul 11 2009 10:56AM |
| Credit: | Discovered by Paul Brereton <[email protected]>. |
| Vulnerable: |
PHP PHP 4.1.2 PHP PHP 4.1 .0 PHP PHP 4.0.6 PHP PHP 4.0.5 PHP PHP 4.0.4 PHP PHP 4.0.3 PHP PHP 4.0.1 pl2 PHP PHP 4.0.1 PHP PHP 4.0 0 Apache Apache 2.0.28 Beta |
| Not Vulnerable: | |
Discussion
PHP Include File Relative Directory Information Disclosure Vulnerability
Apache is a powerful, widely used web server available for most operating systems, including Linux, Windows and many other Unix like systems. PHP is a widely deployed scripting language, designed for web based development and CGI programming.
A path disclosure vulnerability exists in the default configuration of some releases of PHP when used with the Apache web server. If PHP include files are references with a relative directory, it is possible to cause the include statement to fail. Submitting a request for a php file appended with a trailing slash '/', will return an error message and the full path to the include file directory.
'Require' statements may also be susceptible to this issue.
Apache is a powerful, widely used web server available for most operating systems, including Linux, Windows and many other Unix like systems. PHP is a widely deployed scripting language, designed for web based development and CGI programming.
A path disclosure vulnerability exists in the default configuration of some releases of PHP when used with the Apache web server. If PHP include files are references with a relative directory, it is possible to cause the include statement to fail. Submitting a request for a php file appended with a trailing slash '/', will return an error message and the full path to the include file directory.
'Require' statements may also be susceptible to this issue.
Exploit / POC
PHP Include File Relative Directory Information Disclosure Vulnerability
No exploit code is required.
No exploit code is required.
Solution / Fix
PHP Include File Relative Directory Information Disclosure Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PHP Include File Relative Directory Information Disclosure Vulnerability
References:
References:
- Apache Software Foundation Homepage (Apache Software Foundation)
- PHP: Manual: error_reporting (PHP Development Team.)