CVE-2010-1130

session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

9.55% chance of exploitation in the next 30 days, 95th percentile

Published

2010-03-26

Updated

2024-09-16

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/33625

Security advisories

• http://secunia.com/advisories/38708
• http://www.vupen.com/english/advisories/2010/0479
• http://www.php.net/releases/5_2_13.php

References

• CVE Record
• NVD entry