Bug #14909: Allows access to ANY file

From:	leighgardiner at hotmail dot com	Date:	Mon, 07 Jan 2002 14:34:05 +0000
Subject:	Bug #14909: Allows access to ANY file
Groups:	php.dev
Request:	Send a blank email to php-dev+get-76184@lists.php.net to get a copy of this message

From:             leighgardiner@hotmail.com
Operating system: Windows
PHP version:      4.1.1
PHP Bug Type:     Apache related
Bug description:  Allows access to ANY file

Well you should have already heard about this but I'll report it anyway
becoz we all need a fix very fast! Well when you do this:
http://www.example.com/php/php.exe?c:\winnt\repair\sam
  (this is an
example, you can view any file) it will return the files contents! This
happens with ANY windows versions...i don't think it affects linux. Also
this will return the install path of PHP:
http://www.example.com/php/php4ts.dll
could you please get a path/new vesion out ASAP! This is extremly serious!
-- 
Edit bug report at: http://bugs.php.net/?id=14909&edit=1



   

Thread (9 messages)

• leighgardiner at hotmail dot comMon, 07 Jan 2002 14:34:05 +0000
  • georg@php.netMon, 07 Jan 2002 14:41:20 +0000Bug #14909 Updated: Allows access to ANY file
  • imajes@php.netMon, 07 Jan 2002 14:46:59 +0000Bug #14909 Updated: Allows access to ANY file
  • goba@php.netMon, 07 Jan 2002 17:02:52 +0000Bug #14909 Updated: Allows access to ANY file
  • imajes@php.netTue, 08 Jan 2002 08:28:11 +0000Bug #14909 Updated: Allows access to ANY file
  • sander@php.netTue, 08 Jan 2002 12:16:40 +0000Bug #14909 Updated: Allows access to ANY file
  • imajes@php.netTue, 08 Jan 2002 13:03:10 +0000Bug #14909 Updated: Allows access to ANY file
  • leighgardiner at hotmail dot comWed, 09 Jan 2002 07:17:18 +0000Bug #14909 Updated: Allows access to ANY file
  • christian_holler at web dot deWed, 09 Jan 2002 14:56:41 +0000Bug #14909 Updated: Allows access to ANY file