NetSight
IP …
medium5.0Public exploit code

CVE-2010-1130

session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_pa…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).

Affected products

VendorProductAffected versions
PhpPhp
through 5.2.12
Versions 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4

Weakness classification

CWE-264

References