CVE-2010-1130

Vulnerability

The session.c component of the PHP session extension improperly interprets semicolon (;) characters in the argument passed to session_save_path(). In PHP versions before 5.2.13 and 5.3.1, an attacker can supply a path argument containing multiple semicolons combined with directory traversal sequences (..) to bypass open_basedir and safe_mode restrictions [1][2][3]. The parser treats the semicolon as a separator between a numeric depth value and a path, but does not sufficiently validate the resulting path, allowing writes outside the intended directory [2][3].

Exploitation

An attacker must have the ability to call session_save_path() (either directly or via ini_set()) with a user-controlled argument, which requires some level of access, typically in a shared hosting or application environment where the function is exposed. The attacker supplies a value such as 0;/tmp/../attacker_controlled_path where the .. component traverses upward from the intended base directory. Multiple semicolons can be injected to confuse the parsing logic and achieve a filesystem path escape [2][3]. No authentication or user interaction beyond the ability to set the session save path is required [2][3].

Impact

Successful exploitation allows an attacker to write session files outside the intended session.save_path directory, thereby bypassing open_basedir and safe_mode restrictions. This can lead to local file creation or overwrite in arbitrary locations (subject to filesystem permissions), potentially enabling further compromise such as code execution if the attacker can control file content and location [1][2][4]. The impact is limited by the PHP process's write permissions on the target filesystem.

Mitigation

PHP 5.2.13 and 5.3.2 (the fix was included in 5.3.2, released after the advisory) contain the proper fix for this vulnerability [1][4]. Users should upgrade to these versions or later. No workaround is available if the session extension is enabled; however, disabling session_save_path() usage or restricting the argument via custom code may be possible in some environments. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.