CVE-2003-0097
HIGH severity · CVSS 7.5
7.5CVSS HIGH
Summary
Unknown vulnerability in CGI module for PHP 4.3.0 allows attackers to access arbitrary files as the PHP user, and possibly execute PHP code, by bypassing the CGI force redirect settings (cgi.force_redirect or --enable-force-cgi-redirect).
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impact—
Exploit probability (EPSS)2%
AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://www.iss.net/security_center/static/11343.phpAdvisory
- http://marc.info/?l=bugtraq&m=104550977011668&w=2
- http://marc.info/?l=bugtraq&m=104567042700840&w=2
- http://marc.info/?l=bugtraq&m=104567137502557&w=2
- http://www.securityfocus.com/bid/6875
- http://www.slackware.com/changelog/current.php?cpu=i386