Re: PHP 4.0 Bug #8795: Recieved POST-form-data is unexpectedly escaped with backslashes
| From: | Ignacio Vazquez-Abrams | Date: | Fri, 19 Jan 2001 17:02:44 +0000 |
| Subject: | Re: PHP 4.0 Bug #8795: Recieved POST-form-data is unexpectedly escaped with backslashes | ||
| References: | 1 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-44580@lists.php.net to get a copy of this message | ||
On Thu, 18 Jan 2001, Toby Butzon wrote:
> As a side note, check this link out ;)
> http://[removed]?file=/etc/passwd
>
> --Toby
>
Oh come on. Exposing this file even with shadow passwords in place is still a
HUGE risk, because now your userids are exposed and your system is vulnerable
to a brute-force attack. Never, EVER, do something as silly as this,
especially in a public forum.
--
Ignacio Vazquez-Abrams <ignacio@openservices.net>