CVE-2007-0448

The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI.

🔗 References (6)

• cve@mitrehttp://securityreason.com/achievement_securityalert/44
• cve@mitrehttp://securityreason.com/securityalert/2175
• cve@mitrehttp://www.securityfocus.com/bid/22261
• af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/achievement_securityalert/44
• af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/2175
• af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/22261