nginx + php-fcgi : 0day exploit ?
| From: | Jérôme Loyet | Date: | Fri, 21 May 2010 19:58:53 +0000 |
| Subject: | nginx + php-fcgi : 0day exploit ? | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-48379@lists.php.net to get a copy of this message | ||
Hi guys,
On the nginx mailing list, there is an interesting conversation about
the usage of php through fastcgi with nginx which can cause a security
hole:
http://forum.nginx.org/read.php?2,88845
I don't really know the origin of the fix_pathinfo ini variable. So I
don't know if it's really a bug or a mis-configuration.
What do you think ?
++ Jerome