Input validation error in PHP - CVE-2002-0229
Published: October 18, 2016 / Updated: June 10, 2025
Vulnerability identifier: #VU110544
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2002-0229
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Safe Mode feature (safe_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restrictions and read arbitrary files using "LOAD DATA INFILE LOCAL" SQL statements.
Affected software
PHP
How to mitigate CVE-2002-0229
Install update from vendor's website.
PHP - addressed in versions 3.0.17, 4.0.7, 4.10
Links to Public Exploits and PoC-codes
- Exploit #11521 - PHP 4.x/5.x MySQL Library - 'Safe_mode' Filesystem Circumvention (1) (June 10, 2025)
- Exploit #11520 - PHP 4.x/5.x MySQL Library - 'Safe_mode' Filesystem Circumvention (2) (June 10, 2025)
- Exploit #11519 - PHP 4.x/5.x MySQL Library - 'Safe_mode' Filesystem Circumvention (3) (June 10, 2025)
External References
- http://marc.info/?l=bugtraq&m=101286577109716&w=2
- http://marc.info/?l=bugtraq&m=101304702002321&w=2
- http://marc.info/?l=ntbugtraq&m=101285016125377&w=2
- http://marc.info/?l=ntbugtraq&m=101303065423534&w=2
- http://marc.info/?l=ntbugtraq&m=101303819613337&w=2
- http://www.iss.net/security_center/static/8105.php
- http://www.securityfocus.com/bid/4026