Vulnerabilities > CVE-2004-2692 - Configuration vulnerability in Kyberdigi Labs PHP-Exec-Dir

CVSS 0.0 - NONE

Attack vector

UNKNOWN

Attack complexity

UNKNOWN

Privileges required

UNKNOWN

Confidentiality impact

UNKNOWN

Integrity impact

UNKNOWN

Availability impact

UNKNOWN

kyberdigi-labs

CWE-16

exploit available

NVD

Published: 2004-12-31

Updated: 2024-11-20

Summary

The exec_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick operator, which is not handled using the php_escape_shell_cmd function.

Vulnerable Configurations

Part	Description	Count
Application	Kyberdigi_Labs Kyberdigi Labs PHP Exec DIR 4.3.7 Kyberdigi Labs PHP Exec DIR 4.3.3 Kyberdigi Labs PHP Exec DIR 4.3.4 Kyberdigi Labs PHP Exec DIR 4.3.5 Kyberdigi Labs PHP Exec DIR 4.3.6 Kyberdigi Labs PHP Exec DIR 4.3.2	6

Common Weakness Enumeration (CWE)

CWE-16 - Configuration

Exploit-Db

description	PHP (php-exec-dir) Patch Command Access Restriction Bypass. CVE-2004-2692. Webapps exploit for php platform
id	EDB-ID:384
last seen	2016-01-31
modified	2004-08-08
published	2004-08-08
reporter	VeNoMouS
source	https://www.exploit-db.com/download/384/
title	PHP php-exec-dir Patch Command Access Restriction Bypass

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Exploit-Db

References