Major Security hole in php
| From: | gnif at goldweb dot com dot au | Date: | Sat, 23 Feb 2002 05:05:12 +0000 |
| Subject: | Major Security hole in php | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-8815@lists.php.net to get a copy of this message | ||
Hi, my name is Geoffrey and I think I have found a major hole in php or the
configuration on most servers. If you make a page from the following code you
will see the problem, just goto the url of the page and put ?page=. on the end.
<?PHP
if ($page)
{
if ($dir = @opendir("$page")) {
while (($file = readdir($dir)) !== false)
{
if (is_dir ("$page$file"))
{$dirs[]=$file; } else {$files[]="$file";}
}
closedir($dir);
}
@sort($dirs);
@reset($dirs);
@sort($files);
@reset($files);
$page = stripslashes($page);
$dircount=count($dirs);
for ($count="0"; $count <= $dircount; $count++)
{
echo("<a href='?page=$page$dirs[$count]/'><b>$dirs[$count]
</b></a><br>".Chr(13));
}
$filecount=count($files);
for ($count="0"; $count <= $filecount; $count++)
{
echo("<a
href='?open=$page$files[$count]'>$files[$count]</a><br>".Chr
(13));
}
} else {include($open);}
?>
----------------------------------------------------------------------
This e-mail was brought to you by Goldweb Internet Web Mail Interface
URL: http://www.goldweb.com.au/