CVE-2010-1130

PHP <5.2.13, 5.3.1 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-1130. PoCs published by Grzegorz Stachowiak.

AI-analyzed exploit summary This exploit bypasses PHP's safe_mode restrictions by manipulating the session_save_path to write session files to arbitrary directories. It leverages path traversal to escape intended directory constraints in shared hosting environments.

Description

session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).

Exploits (1)

exploitdb WORKING POC VERIFIED
by Grzegorz Stachowiak · phpdosphp
https://www.exploit-db.com/exploits/33625

This exploit bypasses PHP's safe_mode restrictions by manipulating the session_save_path to write session files to arbitrary directories. It leverages path traversal to escape intended directory constraints in shared hosting environments.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: PHP (versions with safe_mode enabled)
No auth needed
Prerequisites: PHP safe_mode enabled · Shared hosting environment with multiple users
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (11)

Core 11
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/0479
Patch x_refsource_confirm
http://www.php.net/releases/5_2_13.php
Vendor Advisory x_refsource_confirm
http://www.php.net/ChangeLog-5.php
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/38708
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1023661
Third Party Advisory third-party-advisory x_refsource_sreasonres
http://securityreason.com/achievement_securityalert/82
Exploit third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/7008

Scores

EPSS 0.0930
EPSS Percentile 94.7%

Details

CWE
CWE-264
Status published
Products (28)
php/php 5.0.0 (8 CPE variants)
php/php 5.0.1
php/php 5.0.2
php/php 5.0.3
php/php 5.0.4
php/php 5.0.5
php/php 5.1.0
php/php 5.1.1
php/php 5.1.2
php/php 5.1.3
... and 18 more
Published Mar 26, 2010
Tracked Since Feb 18, 2026