Re: Re: hacked!!
| From: | Jim Giner | Date: | Sat, 04 Oct 2014 02:51:19 +0000 |
| Subject: | Re: Re: hacked!! | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-323927@lists.php.net to get a copy of this message | ||
On 10/3/2014 8:04 PM, Richard wrote:
------------ Original Message ------------Date: Friday, October 03, 2014 19:51:59 -0400 From: Jim Giner <jim.giner@albanyhandball.com> To: php-general@lists.php.net Subject: Re: [PHP] Re: hacked!! On 10/3/2014 5:11 PM, ellis@spinics.net wrote:There is no requirement that your scripts (be programmed to) upload files. All it takes is for you to have a poorly written php script, e.g., perhaps something where you don't properly/fully sanitize values you pick up from the QUERY_STRING, for a hacker to be able to modify a file (assuming that the file permissions are set inappropriately). What are the ownerships and permissions on the directories and files under your web root?None of my scripts do any file uploading (to the server). None. I still don't know how I can tell what permissions the web server has.And how do I know what the web server can do?The web server *executes* PHP scripts. Most likely one or more of those scripts has a bug that was used to write files into your document tree. Your document tree should not be writable but most likely is. -- http://www.spinics.net/lists/- RichardYou mean like '644'?