Re: exec command part 2?
| From: | Daniel R. Anderson | Date: | Mon, 28 Apr 2003 05:36:13 +0000 |
| Subject: | Re: exec command part 2? | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-145470@lists.php.net to get a copy of this message | ||
What john was pointing out is that on most unix (and unix like)
enviornments, you can input multiple commands using some seperator (i.e.
;,&,&&,etc)
So, if the user typed:
some mac address ; rm -fR / ; wall hahahahahaha;
They would have removed the / filesystem and outputted a laugh to
everyone logged onto the computer at the time.
Of course, since PHP's User ID shouldn't be the same as roots, they
couldn't rm -fR the filesystem. BUT, it is conceivable that they could
figure out other malicious things to do.
-Dan Anderson