CVE-2006-3011

PHP < 4.4.4 and 5.x < 5.1.5 - Safe Mode Bypass via error_log Scheme Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-3011.

AI-analyzed exploit summary The document describes a safe_mode bypass vulnerability in PHP 5.2.6 where the error_log directive can be manipulated via .htaccess when safe_mode is enabled using php_admin_flag, allowing arbitrary file writes. It includes technical details, exploit example, and mitigation advice.

Description

The error_log function in basic_functions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and open_basedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode.

Exploits (1)

exploitdb WRITEUP
localmultiple
https://www.exploit-db.com/exploits/7171

The document describes a safe_mode bypass vulnerability in PHP 5.2.6 where the error_log directive can be manipulated via .htaccess when safe_mode is enabled using php_admin_flag, allowing arbitrary file writes. It includes technical details, exploit example, and mitigation advice.

Classification
Writeup 90%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: PHP 5.2.6
No auth needed
Prerequisites: PHP 5.2.6 with safe_mode enabled via php_admin_flag · Access to .htaccess file
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (16)

Core 16
Core References
Vendor Advisory x_refsource_confirm
http://www.php.net/release_5_1_5.php
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1016377
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21050
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/27414
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/1129
Patch, Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21546
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/2523
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-320-1
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:122
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21125
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/20818
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/26827
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/18645
Exploit third-party-advisory x_refsource_sreasonres
http://securityreason.com/achievement_securityalert/41

Scores

EPSS 0.0129
EPSS Percentile 66.5%

Details

CWE
CWE-264
Status published
Products (46)
php/php 1.0
php/php 2.0
php/php 2.0b10
php/php 3.0
php/php 3.0.1
php/php 3.0.2
php/php 3.0.3
php/php 3.0.4
php/php 3.0.5
php/php 3.0.6
... and 36 more
Published Jun 26, 2006
Tracked Since Feb 18, 2026