Description
The copy function in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass safe mode and read arbitrary files via a source argument containing a compress.zlib:// URI.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP 4.x - 'copy() Safe_Mode' Bypass EDB-27596 · remote · Apr 10, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 19775 third-party-advisory
- php-copy-safemode-bypass(25706) vdb-entry
- 20060718 new shell bypass safe mode mailing-list
- 20060408 copy() Safe Mode Bypass PHP 4.4.2 and 5.1.2 third-party-advisory
- 678 third-party-advisory
- ADV-2006-1290 vdb-entry
- USN-320-1 vendor-advisory
- 21125 third-party-advisory
- 19599 third-party-advisory
- MDKSA-2006:074 vendor-advisory
- 24487 vdb-entry
- 20060409 copy() Safe Mode Bypass PHP 4.4.2 and 5.1.2 mailing-list
- http://us.php.net/releases/5_1_3.php
- 1015882 vdb-entry
- 17439 vdb-entry
- 20060723 Re: new shell bypass safe mode mailing-list