Re: file upload, again
| From: | Brian Mauter | Date: | Wed, 14 Nov 2001 16:11:12 +0000 |
| Subject: | Re: file upload, again | ||
| Groups: | php.db | ||
| Request: | Send a blank email to php-db+get-14323@lists.php.net to get a copy of this message | ||
To get around this, I made a small shell script which runs as root. The php
page calls the script via the system call. All the shell script does is
move a specific file from tmp to a specific location.
I'm probably asking for someone to exploit it, but I don't know exactly what
they can do.
-Brian