PHP 5.2 - FOpen 'Safe_mode' Restriction Bypass

Author: Maksymilian Arciemowicz
type: local
platform: php
port: 0
date_added: 2007-01-26
date_updated: 2013-11-11
verified: 1
codes: CVE-2007-0448;OSVDB-33928
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/22261/info

PHP is prone to a 'safe_mode' restriction-bypass vulnerability. Successful exploits could allow an attacker to write files in unauthorized locations; other attacks may also be possible.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code, all assuming that the 'safe_mode' restriction will isolate users from each other.

This issue is reported to affect PHP version 5.2.0; other versions may also be vulnerable.

php -r 'fopen("srpath://../../../../../../../dir/pliczek", "a");'