Description
The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI.
Remediation
References
Related Vulnerabilities
WordPress Plugin TDO Mini Forms Arbitrary File Upload (0.13.9)
PHP Out-of-bounds Write Vulnerability (CVE-2016-7127)
WordPress Plugin Advanced Dynamic Pricing for WooCommerce Cross-Site Request Forgery (4.1.3)
Liferay Portal CVE-2021-38266 Vulnerability (CVE-2021-38266)
WordPress Plugin Task Manager Pro Multiple Vulnerabilities (1.3.1)