Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-4018. PoCs published by Hamid Ebadi.
AI-analyzed exploit summary This exploit bypasses PHP safe mode by leveraging a vulnerability in the `getuid` function to execute arbitrary shellcode or establish a reverse shell. It supports Linux and FreeBSD targets and can be used in RFI/LFI scenarios.
Description
The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LD_LIBRARY_PATH environment variable.
Exploits (1)
This exploit bypasses PHP safe mode by leveraging a vulnerability in the `getuid` function to execute arbitrary shellcode or establish a reverse shell. It supports Linux and FreeBSD targets and can be used in RFI/LFI scenarios.