note 73618 deleted from function.phpinfo by nlopess
| From: | nlopess@php.net | Date: | Mon, 05 Mar 2007 16:42:44 +0000 |
| Subject: | note 73618 deleted from function.phpinfo by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-124107@lists.php.net to get a copy of this message | ||
Note Submitter: andrew at weekendhosting dot com
----
As revealed by the Month of PHP Bugs, phpinfo() has a XSS vunerability. I know a lot of new
developers won't know about the Month of Bugs, so I think it's important to let people
know here.
Do not use phpinfo() on a live site, it's extremely easy to google for, and, it's a very
easy hack to use.
Andrew