Exploitation Summary
EIP tracks 1 public exploit for CVE-2007-1835. PoCs published by Stefan Esser.
AI-analyzed exploit summary This exploit bypasses PHP's 'open_basedir' restriction by manipulating session save paths and environment variables, allowing unauthorized file access or writing in shared hosting environments. It leverages a design error in PHP versions 4.4.6 and 5.2.1.
Description
PHP 4 before 4.4.5 and PHP 5 before 5.2.1, when using an empty session save path (session.save_path), uses the TMPDIR default after checking the restrictions, which allows local users to bypass open_basedir restrictions.
Exploits (1)
This exploit bypasses PHP's 'open_basedir' restriction by manipulating session save paths and environment variables, allowing unauthorized file access or writing in shared hosting environments. It leverages a design error in PHP versions 4.4.6 and 5.2.1.