PHP ＜= 4.4.7 / 5.2.3 MySQL/MySQLi Safe Mode Bypass Vulnerability

セキュリティ

MysqlのLOCAL INFILEがPHPのSafe_modeをバイパスして、--desable-local-infoleオプションも無視されてしまうそうです。

でも、このスクリプト見る限り当然の動きだと思うんですけど・・・違うんですかねぇ。

By using MySQLs LOCAL INFILE we could bypass PHP's safe_mode security restriction. An important thing here is that we can't rely on the shared hosts MySQLds local-infile=0 option. This because of it being a server option, so it will not have any effect on the client. To disable this option for MySQL we need to compile libmysqlclient with --disable-local-infile, or remove the CLIENT_LOCAL_FILES flag while connecting. PHP does this when open_basedir are in effect but lacks a check for safe_mode.
For MySQLi compiling with --disable-local-infile won't help because we could just reenable it with mysqli->options(MYSQLI_OPT_LOCAL_INFILE, 1);