medium6.2Public exploit code

CVE-2006-5178

Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mk…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

PHP 5.2.12/5.3.1 - 'symlink()' open_basedir Bypass2009-12-19 · local · php · Verified

Impact

Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink.

Affected products

Vendor	Product	Affected versions
Php	Php	through 5.1.6 Versions 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4

Weakness classification

CWE-362

Public exploit code

Impact

Affected products

Weakness classification

References