Re: RFC: source files without opening tag

From: Date: Mon, 09 Apr 2012 20:38:03 +0000
Subject: Re: RFC: source files without opening tag
References: 1 2 3 4 5 6 7 8 9 10 11 12 13  Groups: php.internals 
Request: Send a blank email to internals+get-59547@lists.php.net to get a copy of this message
Hi! > 1. Find FLI vulnerable application. > 2. Find a way to inject $_SESSION > 3. Use session file to execute arbitrary PHP code. So, you assume you have broken application with no security AND it allows you to inject arbitrary data in the session (which probably means broken authorization too) and then somehow it's PHP vulnerability? I'm sorry but this does not make too much sense to me. If you have an application that allows to execute arbitrary code on external request, this app has no security. How it is a vulnerability in PHP? -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227

« previous php.internals (#59547) next »