CVE-2008-2666
CVE-2008-2666
Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function.
Affected products
n/a · n/apublic PoCs found — 1
exploitdbwww.exploit-db.com/exploits/31937unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlhttp://marc.info/?l=bugtraq&m=124654546101607&w=2http://marc.info/?l=bugtraq&m=125631037611762&w=2http://secunia.com/advisories/32746http://secunia.com/advisories/35074http://secunia.com/advisories/35650http://security.gentoo.org/glsa/glsa-200811-05.xmlhttp://securityreason.com/achievement_securityalert/55http://securityreason.com/securityalert/3942https://exchange.xforce.ibmcloud.com/vulnerabilities/43198http://support.apple.com/kb/HT3549http://wiki.rpath.com/Advisories:rPSA-2009-0035