CVE-2003-0249 Security feature bypass in n/a
Attackers can bypass Apache method-based access controls by using non-standard HTTP methods, as PHP treats them as GET requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2003-0249?
CVE-2003-0249 is a high-severity vulnerability in Php Php, published on 27 Feb 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PHP treats unknown methods such as "PoSt" as a GET request, which could allow attackers to intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0, as demonstrated using a Limit directive. NOTE: this issue has been disputed by the Apache security team, saying "It is by design that PHP allows scripts to process any request method. A script which does not explicitly verify the request method will hence be processed as normal for arbitrary methods. It is therefore expected behaviour that one cannot implement per-method access control using the Apache configuration alone, which is the assumption made in this report.
Which versions are affected by CVE-2003-0249?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2003-0249?
No fix has been published for CVE-2003-0249 yet. Limit exposure of the affected software until one is available.
Is CVE-2003-0249 being exploited?
There is no known exploitation of CVE-2003-0249 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-xc5f-pfpm-hrw6.