CVE-2008-5625

PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows…

published December 17, 2008

CVSS
—
EPSS
7%
Percentile
94.3
In the wild
Unconfirmed
What it is

PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows context-dependent attackers to write to arbitrary files by placing a "php_value error_log" entry in a .htaccess file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07314 · 94.3th percentile
Published
2008-12-17T17:00Z
EPSS history
Timeline
  • 17 DEC 17:00Z
    PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows…
    cvelistv5