note 51293 deleted from security.apache by betz
| From: | betz@php.net | Date: | Wed, 15 Feb 2006 22:04:52 +0000 |
| Subject: | note 51293 deleted from security.apache by betz | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-103806@lists.php.net to get a copy of this message | ||
Note Submitter: phil at NOSPAM dot blisswebhosting dot com
----
To Pollox and anyone else considerig using "open_basedir" without safe mode.
Open_basedir does NOT protect against this:
<?
exec("/usr/bin/cat /etc/passwd",$output);
var_dump($output) ;
?>
outputting the password file (which is world readable)
or
<?php
exec("/bin/ls -lhaR /") ;
?>
recursively outputting your filesystem.
ANY system comand can be run through the exec and system function as the apache user. Safe mode and
it's family of configuration options are the ONLY way to protect against this.