CVE-2003-0863
PHP 4.3.x - Unauthenticated File Include Vulnerability via php_check_safe_mode_include_dir
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2003-0863. PoCs published by Michal Krause.
AI-analyzed exploit summary This exploit demonstrates a Safe Mode bypass in PHP by leveraging a logic error in include() and require() functions when safe_mode_include_dir is not defined. It attempts to read /etc/passwd, proving unauthorized file access.
Description
The php_check_safe_mode_include_dir function in fopen_wrappers.c of PHP 4.3.x returns a success value (0) when the safe_mode_include_dir variable is not specified in configuration, which differs from the previous failure value and may allow remote attackers to exploit file include vulnerabilities in PHP applications.
Exploits (1)
This exploit demonstrates a Safe Mode bypass in PHP by leveraging a logic error in include() and require() functions when safe_mode_include_dir is not defined. It attempts to read /etc/passwd, proving unauthorized file access.