Bug #14909 Updated: Allows access to ANY file

ID: 14909 Updated by: imajes Reported By: leighgardiner@hotmail.com Old Status: Bogus Status: Open Old Bug Type: Apache related Bug Type: Documentation problem Operating System: Windows PHP Version: 4.1.1 Old Assigned To: Assigned To: imajes@php.net New Comment: Actually, our documentation tells win32 users to install that way. I'm investigating a better method right now, and will patch the documentation in a short while. I knew i forgot to do something after i updated my win32 last week! Previous Comments: ------------------------------------------------------------------------ [2002-01-07 09:41:20] georg@php.net Unbelievable, why do you set your cgi-binary in the document root tree!? See http://www.cert.org/advisories/CA-1996-11.html ------------------------------------------------------------------------ [2002-01-07 09:34:04] leighgardiner@hotmail.com Well you should have already heard about this but I'll report it anyway becoz we all need a fix very fast! Well when you do this: http://www.example.com/php/php.exe?c:\winnt\repair\sam (this is an example, you can view any file) it will return the files contents! This happens with ANY windows versions...i don't think it affects linux. Also this will return the install path of PHP: http://www.example.com/php/php4ts.dll could you please get a path/new vesion out ASAP! This is extremly serious! ------------------------------------------------------------------------ Edit this bug report at http://bugs.php.net/?id=14909&edit=1