Re: allow_url_fopen ini directive not enough
| From: | KJ | Date: | Sat, 11 Dec 2004 13:05:58 +0000 |
| Subject: | Re: allow_url_fopen ini directive not enough | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-204049@lists.php.net to get a copy of this message | ||
Greg Donald wrote:
On Fri, 10 Dec 2004 22:00:43 +0000, KJ <kelvinj@gmail.com> wrote:No remote connection, quote: "Joe Hacker uses the vunerability to change your account passwd. He then logs in as you and deletes all your files". He's logged onto your box, local connection.5. Joe Hacker has studied the script coz he's a tart that wants to piss people off and he has found a vunerability. 6. Joe Hacker uses the vunerability to change your account passwd. He then logs in as you and deletes all your files. He has access to your mysql password which was in the congif file of phpMyFantasticGuestbookWhy would you allow your MySQL user to connect from anywhere besides your web server? Remote MySQL connections are a big no-no.
phpMyFantasticGuestbook doesn't actually exist, it was a scenario to try to explain the issue. Thanks.and he deletes all your data, he then leaves a nice index.php in your account to say that he's been by.Sorry to hear that, I'd recommend you stop using phpMyFantasticGuestbook immediately. And anything else you don't feel paranoid about to audit.