CVE-2002-0484 in PHP
Summary
by MITRE
move_uploaded_file in PHP does not does not check for the base directory (open_basedir), which could allow remote attackers to upload files to unintended locations on the system.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/01/2025
The vulnerability described in CVE-2002-0484 represents a critical security flaw in the PHP web application scripting language that affects the move_uploaded_file function's handling of file operations. This issue specifically targets the open_basedir restriction mechanism that PHP implements to limit file access to specific directories. The vulnerability exists because PHP's move_uploaded_file function fails to properly validate whether the destination directory falls within the boundaries defined by the open_basedir configuration setting. This oversight creates a pathway for remote attackers to bypass intended security restrictions and upload malicious files to locations outside the designated web root or specified directories.
The technical flaw stems from the improper implementation of directory validation within the move_uploaded_file function. When PHP processes file uploads, it should verify that the target directory for file movement complies with the open_basedir restrictions that administrators set to contain file access within safe boundaries. However, this validation is absent or insufficient in the affected PHP versions, allowing attackers to manipulate file upload destinations through crafted requests. The vulnerability specifically impacts the security model that relies on open_basedir as a containment mechanism for preventing unauthorized file system access, essentially undermining the fundamental principle of least privilege that governs secure file operations in web applications.
Operationally, this vulnerability presents significant risks to web server security and can lead to severe consequences including arbitrary code execution, privilege escalation, and unauthorized data access. Attackers can exploit this weakness to upload malicious files to critical system directories such as cgi-bin, system directories, or other locations where the web server process has elevated privileges. The impact extends beyond simple file upload manipulation as it can enable attackers to place backdoors, web shells, or other malicious payloads in locations that would normally be protected by the open_basedir restrictions. This vulnerability particularly affects web applications that rely on PHP's file upload handling and assume that open_basedir settings provide adequate protection against unauthorized file operations.
The security implications of CVE-2002-0484 align with common attack patterns documented in the ATT&CK framework under the category of privilege escalation and persistence. This vulnerability directly relates to CWE-22, which describes improper limitation of a pathname to a restricted directory, and CWE-73, which covers external control of file name or path. Organizations running affected PHP versions face increased risk of compromise as attackers can leverage this weakness to circumvent security controls that should prevent unauthorized file system access. The vulnerability demonstrates how seemingly minor implementation flaws in core functions can create substantial security gaps that adversaries can exploit to gain unauthorized access to system resources.
Mitigation strategies for this vulnerability require immediate patching of affected PHP installations to versions that properly implement open_basedir validation in move_uploaded_file operations. System administrators should also implement additional security measures including strict input validation for file upload operations, comprehensive monitoring of file system changes, and regular security assessments of web application configurations. The recommended approach involves configuring PHP with restrictive open_basedir settings that limit file access to necessary directories only, implementing proper file type validation, and ensuring that uploaded files are stored in locations that cannot be executed as web content. Additionally, organizations should consider implementing web application firewalls and intrusion detection systems to monitor for suspicious file upload activities that might indicate exploitation attempts against this vulnerability.