CVE-1999-0238

Vulnerability

The php.cgi script in PHP/FI version 2.0 suffers from a directory traversal vulnerability. This flaw allows remote users to browse directories and view files on the local host that the web server's user ID has read access to [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted URL to the php.cgi script, typically in the format http://www.someurl.com/php.cgi?/path/to/file. This allows them to navigate the server's file system and access restricted resources [1].

Impact

Successful exploitation allows an attacker to read any file on the system that the web server process has read permissions for. This could lead to the disclosure of sensitive information, such as system configuration details or potentially unencrypted user passwords if the system is not using shadow passwords [1].

Mitigation

No specific patch or fixed version information is available in the provided references. Users are advised to remove or disable the vulnerable php.cgi script if it is not essential for their web server's functionality. Further information on mitigation may be available from the software vendor or security advisories.