CVE-2002-0240 in HTTP Server
Summary
by MITRE
PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2025
This vulnerability exists in PHP applications running on Apache web servers where the server is configured to automatically search for index.php files as default pages. The flaw occurs when the HTTP OPTIONS method is used against the web server, which triggers an error response containing the full server pathname in the error message. This represents a classic information disclosure vulnerability that can be exploited by remote attackers without authentication. The vulnerability stems from improper error handling within the server configuration where sensitive path information is inadvertently exposed through HTTP response headers or error messages. Attackers can leverage this information to gain insights into the server's file structure, which can facilitate further exploitation attempts such as directory traversal attacks or targeted payload delivery. The vulnerability directly relates to CWE-200, which covers information exposure through error messages, and can be categorized under the ATT&CK technique T1212 for Exploitation for Credential Access. When an attacker sends an HTTP OPTIONS request to a PHP-enabled Apache server configured to use index.php as a default document, the server responds with an error message that includes the absolute file path where the PHP files are stored. This information disclosure can be particularly dangerous in environments where the server path reveals sensitive details about the system architecture, including potential file locations, directory structures, and even version information that might be used in subsequent attacks. The vulnerability is especially concerning because it requires no special privileges or authentication to exploit, making it accessible to any remote attacker with network access to the target server. The exposure of the full pathname can provide attackers with crucial information for crafting more sophisticated attacks, such as determining the correct file paths for exploitation attempts or identifying potential weak points in the server configuration. This type of information disclosure can also aid in fingerprinting attacks where the attacker attempts to identify the exact software versions and configurations running on the target system. The vulnerability demonstrates poor security hygiene in web server configuration, where error messages are not properly sanitized to remove potentially sensitive information before being returned to clients. Security practitioners should note that this vulnerability highlights the importance of implementing proper error handling and response management in web applications, particularly in environments where multiple technologies interact such as PHP running on Apache. Organizations should consider implementing custom error pages that do not reveal system-specific information and should regularly audit their server configurations to ensure that sensitive path information is not exposed through HTTP responses. The impact of this vulnerability extends beyond simple information disclosure, as it can serve as a stepping stone for more serious attacks including privilege escalation, data exfiltration, or system compromise. Remediation efforts should focus on configuring Apache to suppress detailed error messages and implementing proper input validation and sanitization practices to prevent the exposure of system information through HTTP responses.