CVE-2002-0229 in PHP
Summary
by MITRE
Safe Mode feature (safe_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restrictions and read arbitrary files using "LOAD DATA INFILE LOCAL" SQL statements.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/21/2025
The vulnerability described in CVE-2002-0229 represents a critical security flaw in PHP versions 3.0 through 4.1.0 that fundamentally undermines the intended security boundaries of the safe_mode feature. This vulnerability operates at the intersection of database access and file system permissions, creating an unexpected pathway for privilege escalation and information disclosure. The safe_mode mechanism was designed to restrict PHP scripts from accessing files outside their designated directories and to prevent execution of certain system commands, thereby providing an additional layer of security in shared hosting environments where multiple users might share the same server resources.
The technical exploitation of this vulnerability relies on the "LOAD DATA INFILE LOCAL" SQL statement which allows MySQL clients to load data from local files into database tables. When PHP's safe_mode is enabled, it should normally prevent scripts from accessing files outside their allowed directories, but the implementation flaw allows attackers with database access to bypass these restrictions. The vulnerability stems from how PHP handles the local file loading functionality within MySQL commands, where the system does not properly validate or restrict the file paths specified in the LOAD DATA INFILE LOCAL statements. This creates a scenario where an attacker can specify arbitrary file paths that would normally be restricted by safe_mode, effectively allowing them to read any file that the MySQL process has access to, regardless of the PHP safe_mode settings.
The operational impact of this vulnerability is severe and far-reaching, particularly in shared hosting environments where multiple users operate on the same server. Attackers with minimal database access can leverage this vulnerability to extract sensitive information from the system, including configuration files, user credentials, application source code, and other confidential data. The vulnerability essentially neutralizes the safe_mode protection mechanism, which was intended to provide isolation between different user accounts and prevent unauthorized access to system resources. This makes it particularly dangerous in environments where database users have limited privileges but still need access to specific data for application functionality. The attack vector demonstrates how database-level access can be weaponized to circumvent application-level security controls, creating a significant escalation of privileges scenario that could lead to complete system compromise.
The vulnerability aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-73 (External Control of File Name or Path) which specifically address path traversal and file path manipulation issues in software systems. From an attack framework perspective, this vulnerability maps to techniques described in the MITRE ATT&CK framework under T1078 (Valid Accounts) and T1566 (Phishing) for initial access, followed by T1005 (Data from Local System) and T1041 (Exfiltration Over C2 Channel) for data extraction and potential further compromise. Organizations using affected PHP versions should immediately implement mitigations including upgrading to patched PHP versions, disabling the problematic MySQL client functionality, and implementing additional database access controls. The vulnerability also highlights the importance of principle of least privilege in database access management, where database users should have minimal required permissions and where application-level security controls should not be solely reliant on database-level access restrictions. This flaw serves as a critical reminder of the need for comprehensive security testing that considers interaction between different system components and the potential for bypassing security controls through unexpected pathways.