Re: Bug #4032: Major security issue PHP+Apache

On Tue, Apr 04, 2000 at 12:15:15PM -0000, liz@xcalibur.demon.co.uk wrote: > From: liz@xcalibur.demon.co.uk > Operating system: Linux Slackware > PHP version: 3.0.11 > PHP Bug Type: Dynamic loading related > Bug description: Major security issue PHP+Apache > > **This maybe a bug with apache, but it seems to honour everything else so.. Apache v1.3.12+PHP > 4.0/RC1* > > Basically it seems if you make a form, and call PHP code as the forms action event.. such as > > <form method=POST > action=http://www.xcalibur.co.uk/t/t/index.html> > Name > <input type=text name=PHP_AUTH_USER size=40> > Password > <input type=text name=PHP_AUTH_PW size=50> > <input type=submit name=submit value=submit> > </form> > > Where the new directory has the password protection on it.... it lets you clean straight in.. > wether you entered correct ID or not! > > I'll leave the 2 pages up to show you > > http://www.xcalibur.co.uk/t/index.html > Enter any id/password (or even not) > > if you close your browser and try and access the file it takes you to G.m1���� > <�=���http://www.xcalibur.co.uk/t/t/index.html you can only get in with an ID of > new and pwd of new > > Before anyone wonders why in hell I was doing this... The server I managed to wangle as my > website doesnt really have compile options, so, Ive had to compiled everything on my server and ftp > it over, everything works bar the install of mysql which uses ginstall which of course isnt (yet) on > the other server. So, I was trying to see if I could use PHP to effectively replace the nasty dialog > boxes, I was a bit concerned when it more than replaced it, it compelely ate it. > > Hope this doesnt cause a problem - I couldnt find the place to submit PHP4 problems.. I hope > you dont tell me to use PHP3 coz, well, Im only learning PHP and I kinda wanted to start with the v4 > product please post the source-code for http://www.xcalibur.co.uk/t/t/index.html > > Liz > > > > -- > PHP Development Mailing List <http://www.php.net/> > To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > For additional commands, e-mail: php-dev-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > -- Thies C. Arntzen "One Big-Mac, Small Fries and a Coke!" Digital Collections Phone +49 40 235350 Fax +49 40 23535180 Hammerbrookstr. 93 20097 Hamburg / Germany