CVE-2001-1247

MEDIUM 6.4 CVSS 2.0

Published: December 6, 2001
Last modified: June 16, 2026
NVD status: Modified
Reported by: cve@mitre.org
Weakness: CWE-264
CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

Description

PHP 4.0.4pl1 and 4.0.5 in safe mode allows remote attackers to read and write files owned by the web server UID by uploading a PHP script that uses the error_log function to access the files.

Affected products and versions

PHP versions 4.0.4pl1, 4.0.5

References

online.securityfocus.com http://online.securityfocus.com/archive/1/194425 Exploit, Patch, Vendor Advisory
www.osvdb.org http://www.osvdb.org/5440
www.php.net http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz
www.redhat.com http://www.redhat.com/support/errata/RHSA-2002-035.html Patch, Vendor Advisory
nvd.nist.gov Official NVD record

PHP CVEs

Description

Affected products and versions

References