Remote File Variable Injection Safety?
| From: | Daniel Kolbo | Date: | Wed, 07 Jan 2009 10:57:49 +0000 |
| Subject: | Remote File Variable Injection Safety? | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-285540@lists.php.net to get a copy of this message | ||
Hello,
suppose there is a file at http://otherhost.com/remote.php that looks like this:
<?php
if (!isset($safe_flag))
{
die("hacking attempt");
}
echo "You are in";
?>
Suppose i executed the following php file at http://myhost.com/local.php
<?php
require_once("http://otherhost.com/remote.php");
?>
Is there any way to get local.php to display "You are in", by only modifying local.php? That is, is there a way to set $safe_flag on the remote host as one requests a file from the remote host from within local.php?
I have genuine, academic, non-belligerent intentions when asking this question.
Thanks,
dK