PHP 4.0 Bug #9353 Updated: Require command reads /etc/passwd

ID: 9353 Updated by: sas Reported By: sebastian@wolfgarten.com Old-Status: Open Status: Closed Bug Type: Unknown/Other Function Assigned To: Comments: Please check out the security section of the manual, especially regarding the safe mode feature. Previous Comments: --------------------------------------------------------------------------- [2001-02-20 09:26:23] sebastian@wolfgarten.com Hello, I have found a bug in PHP 4.01pl2 and maybe it exist in all other php versions too. A php script can read all files on the system when the read flag for everyone is set for that file. This code shows the problem: <? require('../../../../../../../etc/passwd'); ?> It is not a very serious bug but by reading local files a hacker might get important information he (or she) could use to hack into the system. Bye Sebastian Wolfgarten --------------------------------------------------------------------------- ATTENTION! Do NOT reply to this email! To reply, use the web interface found at http://bugs.php.net/?id=9353&edit=2