Vulnerability in PHP
CVE-2010-1130
session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.094 (95.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 95.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.094 · newest: 0.094 · change: 0.000
Affected products
- PHP — versions 5.1.2, 5.0.0, 5.2.3
Weakness classification (CWE)
References
- secunia.com/advisories/38708 (third-party-advisory, Vendor Advisory)
- securityreason.com/achievement_securityalert/82 (third-party-advisory)
- securityreason.com/securityalert/7008 (Exploit, third-party-advisory)
- securitytracker.com/id (vdb-entry)
- svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/session/session.c
- svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/session/session.c
- svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/session/session.c
- svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/session/session.c
- www.php.net/ChangeLog-5.php
- www.php.net/releases/5_2_13.php (Patch)