Description

The php_check_safe_mode_include_dir function in fopen_wrappers.c of PHP 4.3.x returns a success value (0) when the safe_mode_include_dir variable is not specified in configuration, which differs from the previous failure value and may allow remote attackers to exploit file include vulnerabilities in PHP applications.

Remediation

References

CVE-2003-0863

Related Vulnerabilities

Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-4558)

Ruby on Rails Resource Management Errors Vulnerability (CVE-2015-7581)

PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2010-2484)

Joomla! Core Cross-Site Scripting (1.5.0 - 3.8.3)

Internet Information Services Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2010-1256)

Severity

High

Classification

CVE-2003-0863

Tags

Missing Update Known Vulnerabilities