From: hdf at vipmail dot hu Operating system: Win32 PHP version: 4.3.3 PHP Bug Type: *Directory/Filesystem functions Bug description: Big security hole in directory acces system
Description: ------------ It is possible (very easily) to scan the whole filesystem structure of the server, on wich the php script is running, including all partitiones and drives. The problem is I think that there is no limiting option in php, about how many levels upwards in the directory tree are alowed for a script. I have made a little "Troyan horse php script", wich can scan the filesystem of the server, and even read in the textfiles on it. Reproduce code: --------------- http://members.chello.hu/hdf13/MyPrograms/dirlist.zip Expected result: ---------------- It runs perfectly, but it shouldn't. :) Actual result: -------------- The whole server filesystem is visible and browsable and textfiles in it are readeable. Serious security hole! -- Edit bug report at http://bugs.php.net/?id=26471&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=26471&r=trysnapshot4 Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=26471&r=trysnapshot5 Fixed in CVS: http://bugs.php.net/fix.php?id=26471&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=26471&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=26471&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=26471&r=needscript Try newer version: http://bugs.php.net/fix.php?id=26471&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=26471&r=support Expected behavior: http://bugs.php.net/fix.php?id=26471&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=26471&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=26471&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=26471&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=26471&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=26471&r=dst IIS Stability: http://bugs.php.net/fix.php?id=26471&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=26471&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=26471&r=float
