CVE-2004-0490

CVE-2004-0490 describes a local privilege escalation vulnerability in cPanel when configuring Apache 1.3.29 and PHP with mod_phpsuexec. The absence of the --enable-discard-path option causes PHP to use SCRIPT_FILENAME instead of PATH_TRANSLATED, allowing local attackers to execute arbitrary PHP code with another user's privileges by appending their script to a legitimate user's script in a URL. This vulnerability has a CVSS score of 7.2 (High), indicating a local attack vector with low attack complexity and high impacts on confidentiality, integrity, and availability. Its FAUCET Risk Score is 96/100, highlighting its significant potential risk. While not listed in CISA's KEV catalog, an exploit for local privilege escalation (EDB-24141) is available on ExploitDB. The vulnerability has garnered substantial community discussion, with 10 mentions, suggesting awareness and potential interest in its exploitation.