CVE-2008-7002
PHP 5.2.5 - Local Restriction Bypass via exec system shell_exec passthru popen Functions
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-7002. PoCs published by Ciph3r.
AI-analyzed exploit summary This PoC demonstrates a bypass of PHP's 'safe_mode_exec_dir' and 'open_basedir' restrictions in PHP 5.2.5 by executing system commands via functions like 'exec', 'system', 'shell_exec', 'passthru', and 'popen'. It confirms the vulnerability by launching 'calc.exe' when invoked locally.
Description
PHP 5.2.5 does not enforce (a) open_basedir and (b) safe_mode_exec_dir restrictions for certain functions, which might allow local users to bypass intended access restrictions and call programs outside of the intended directory via the (1) exec, (2) system, (3) shell_exec, (4) passthru, or (5) popen functions, possibly involving pathnames such as "C:" drive notation.
Exploits (1)
This PoC demonstrates a bypass of PHP's 'safe_mode_exec_dir' and 'open_basedir' restrictions in PHP 5.2.5 by executing system commands via functions like 'exec', 'system', 'shell_exec', 'passthru', and 'popen'. It confirms the vulnerability by launching 'calc.exe' when invoked locally.