#32836 [Opn->Bgs]: security bug

From: Date: Wed, 27 Apr 2005 02:46:59 +0000
Subject: #32836 [Opn->Bgs]: security bug
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-78250@lists.php.net to get a copy of this message 
 ID:               32836
 Updated by:       iliaa@php.net
 Reported By:      kkrusteff at intergenia dot de
-Status:           Open
+Status:           Bogus
 Bug Type:         Unknown/Other Function
 Operating System: linux
 PHP Version:      4.3.10
 New Comment:

Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to
report
a bug at http://bugs.php.net/how-to-report.php

Validate your inputs.


Previous Comments:
------------------------------------------------------------------------

[2005-04-26 15:53:31] slavi at imperia dot net

See "#29949  	Relative include() sometimes works as expected."
  ( http://bugs.php.net/bug.php?id=29949 )
  
  I think it describes the same problem.

------------------------------------------------------------------------

[2005-04-26 13:58:31] kkrusteff at intergenia dot de

Description:
------------
Frequently used way to include lang file
include("./lang/login.php.$_REQUEST["lang"]);
The problem is if in URL use
lang=../../../../../../../../../../etc/hosts
and we get the host file from computer. 



Reproduce code:
---------------
<?PHP
include("./lang/login.php.../../../../../../../../../../etc/hosts");
?>
//or
<?php
include("./lang/login.php.../../../../../../../../../etc/hosts");
?>
//that's will show the host file 

Expected result:
----------------
file not found 

Actual result:
--------------
that's will show the host file or other file .. if you know the path


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=32836&edit=1

Thread (6 messages)

« previous php.bugs (#78250) next »