cve/2007/CVE-2007-3378.md

CVE-2007-3378

Description

The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safe_mode and open_basedir restrictions and possibly execute arbitrary commands, as demonstrated using (a) php_value, (b) php_flag, and (c) directives in .htaccess.

POC

Reference

• http://seclists.org/fulldisclosure/2020/Sep/34
• http://securityreason.com/achievement_exploitalert/9
• http://www.openwall.com/lists/oss-security/2020/09/17/3

Github

No PoCs found on GitHub currently.