CVE

Id
4645  
CVE No.
CVE-2002-0253  
Status
Candidate  
Description
PHP, when not configured with the "display_errors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an include file via a trailing slash in a request to a directly accessible PHP program, which modifies the base path, causes the include directive to fail, and produces an error message that contains the path.  
Phase
Proposed (20020502)  
Votes
ACCEPT(1) Frech | NOOP(6) Armstrong, Christey, Cole, Cox, Foat, Wall  
Comments
Christey> Is this another case when PHP leaks path information by design, | as supported by "display_errors" option? Then the | vulnerability (rather, exposure) would be in the use of the | display_errors option itself, whose implications may include | this particular scenario. | CHANGE> [Cox changed vote from REVIEWING to NOOP]  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
23276 4645 CVE-2002-0253 BUGTRAQ:20020207 Advisory #3 - PHP & JSP  View
23277 4645 CVE-2002-0253 URL:http://marc.info/?l=bugtraq&m=101318944130790&w=2  View
23278 4645 CVE-2002-0253 BID:4063  View
23279 4645 CVE-2002-0253 URL:http://www.securityfocus.com/bid/4063  View
23280 4645 CVE-2002-0253 XF:php-slash-path-information(8122)  View

Related JVN