7.2high
CVE-2008-70021 exploit
PHP 5.2.5 does not enforce (a) open_basedir and (b) safe_mode_exec_dir restrictions for certain functions, which might allow local users to…
Published 17 y ago · modified 4 mo ago · JSON
CVSS
7.2
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 58%
Public exploits
1
Exploit-DB
Summary
PHP 5.2.5 does not enforce (a) open_basedir and (b) safe_mode_exec_dir restrictions for certain functions, which might allow local users to bypass intended access restrictions and call programs outside of the intended directory via the (1) exec, (2) system, (3) shell_exec, (4) passthru, or (5) popen functions, possibly involving pathnames such as "C:" drive notation.
Exploit prediction (EPSS)
0.83% probability of exploitation in the next 30 days, higher than 58% of all scored CVEs.
Exploits and detections
- EDB-32343 PHP 5.2.5 - Multiple functions 'safe_mode_exec_dir' / 'open_basedir' Restriction Bypass Vulnerabilities · local · 2008-09-08
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
- CWE-264 Permissions, Privileges, and Access Controls
- Technology feeds
- PHP (RSS, critical only)
References
- securityfocus.com /bid/31064 · vdb-entry, x_refsource_BID, x_transferred
- downloads.securityfocus.com /vulnerabilities/exploits/31064.php · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2008-7002
- NVD: CVE-2008-7002
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.