CVE-2008-2666
PHP < 5.2.6 - Directory Traversal via http URL Argument to chdir or ftok
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-2666. PoCs published by Maksymilian Arciemowicz.
AI-analyzed exploit summary This exploit demonstrates a PHP safe_mode bypass vulnerability (CVE-2008-2666) by using a URL path traversal technique (http://../../etc/) to bypass directory restrictions. It allows an attacker to change directories to unauthorized locations despite safe_mode restrictions.
Description
Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function.
Exploits (1)
This exploit demonstrates a PHP safe_mode bypass vulnerability (CVE-2008-2666) by using a URL path traversal technique (http://../../etc/) to bypass directory restrictions. It allows an attacker to change directories to unauthorized locations despite safe_mode restrictions.