CVE-2000-0059

PHP3 - Remote Command Execution via popen Shell Metacharacter Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2000-0059. PoCs published by Kristian Koehntopp.

AI-analyzed exploit summary This exploit demonstrates a bypass of PHP's safe_mode by leveraging the popen() function, which fails to apply EscapeShellCmd(). It allows arbitrary command execution (e.g., 'ls' and 'id') outside the webroot directory.

Description

PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to execute commands.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Kristian Koehntopp · phpremotephp
https://www.exploit-db.com/exploits/19708

This exploit demonstrates a bypass of PHP's safe_mode by leveraging the popen() function, which fails to apply EscapeShellCmd(). It allows arbitrary command execution (e.g., 'ls' and 'id') outside the webroot directory.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: PHP Version 3.0
No auth needed
Prerequisites: PHP 3.0 with safe_mode enabled · Application using popen()
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/911

Scores

EPSS 0.1092
EPSS Percentile 95.3%

Details

Status published
Products (14)
php/php 3.0
php/php 3.0.1
php/php 3.0.2
php/php 3.0.3
php/php 3.0.4
php/php 3.0.5
php/php 3.0.6
php/php 3.0.7
php/php 3.0.8
php/php 3.0.9
... and 4 more
Published Jan 04, 2000
Tracked Since Feb 18, 2026