Re: Remote File Variable Injection Safety?
| From: | Shawn McKenzie | Date: | Wed, 07 Jan 2009 16:47:42 +0000 |
| Subject: | Re: Remote File Variable Injection Safety? | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-285573@lists.php.net to get a copy of this message | ||
Daniel Kolbo wrote:
> Hello,
>
> suppose there is a file at http://otherhost.com/remote.php that
> looks
> like this:
>
> <?php
> if (!isset($safe_flag))
> {
> die("hacking attempt");
> }
> echo "You are in";
> ?>
>
> Suppose i executed the following php file at
> http://myhost.com/local.php
>
> <?php
> require_once("http://otherhost.com/remote.php");
> ?>
>
> Is there any way to get local.php to display "You are in", by only
> modifying local.php? That is, is there a way to set $safe_flag on the
> remote host as one requests a file from the remote host from within
> local.php?
>
> I have genuine, academic, non-belligerent intentions when asking this
> question.
>
> Thanks,
> dK
>
>
>
local.php
<?php
$safe_flag = 1;
require_once("http://otherhost.com/remote.php");
?>
--
Thanks!
-Shawn
http://www.spidean.com