Description
PHP 5.2.5 does not enforce (a) open_basedir and (b) safe_mode_exec_dir restrictions for certain functions, which might allow local users to bypass intended access restrictions and call programs outside of the intended directory via the (1) exec, (2) system, (3) shell_exec, (4) passthru, or (5) popen functions, possibly involving pathnames such as "C:" drive notation.
Remediation
References
Related Vulnerabilities
phpMyFAQ Sensitive Cookie in HTTPS Session Without 'Secure' Attribute Vulnerability (CVE-2023-5866)
XWiki CVE-2022-31166 Vulnerability (CVE-2022-31166)
WordPress Plugin MobileView by ColorLabs & Company Cross-Site Scripting (1.0.7)
WordPress Plugin Persian Woocommerce SMS Cross-Site Scripting (3.3.2)
Jenkins Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-1000356)