|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #14883 Remote vulnerability allows access to ALL files on webserver
Submitted: 2002-01-06 02:12 UTC Modified: 2002-02-28 20:53 UTC
Avg. Score:5.0 ± 0.0
Reproduced:5 of 5 (100.0%)
Same Version:3 (60.0%)
Same OS:4 (80.0%)
From: pbtech at cornell dot edu Assigned:
Status: Closed Package: Other web server
PHP Version: 4.1.1 OS: Windows NT (all Win32)
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: pbtech at cornell dot edu
New email:
PHP Version: OS:


 [2002-01-06 02:12 UTC] pbtech at cornell dot edu
Report yesterday (4 Jan 02) at outlines the security hole.  I have tested it on NT4, Apache 1.3.9, PHP 4.0.4 and then upgraded to NT4, Apache 1.3.22, PHP 4.1.1 and the problem remains.  I've been monitoring the PHP newsgroups (announcements and Windows user lists) since the vulnerability was announced and searched the buglist but haven't found mention of it anywhere.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2002-02-28 06:28 UTC] paul at whichone dot net
Actually, this exploit allows anyone to gain root access to the Machine and so the severity should be ugraded to High.
 [2002-02-28 19:54 UTC]
I think document is updated so that users can set up Apache corretly, right?
(Not yet?)
 [2002-02-28 19:59 UTC] shane at caraveo dot com
The problem can be avoided by setting doc_root in php.ini.  Meanwhile, I've submitted a quick patch to cvs.  Working right now on a full patch.
 [2002-02-28 20:04 UTC]
Not a doc prob...RTFM

 [2002-02-28 20:32 UTC]
I just would like to make sure if document in source is ok also.
Could anyone check it?

And I would like to open this report since is willing
to write patch for this :)

Could you change Category to Apache problem after checking doc in source?
 [2002-02-28 20:53 UTC]
Shane has already commited the fix to CVS :)
 [2002-02-28 20:59 UTC] shane at caraveo dot com
It's still not a full solution.  PHP is going out by default with a big hole, and most users will not read that part of the docs to figure out that PHP CGI has that hole.  The patch I've now submitted turns on FORCE_REDIRECT by default, but it can be turned off (IIS for example needs it off) in the php.ini file.
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Fri Dec 08 10:01:28 2023 UTC