note 117865 deleted from function.eval by googleguy
| From: | googleguy@php.net | Date: | Sun, 23 Aug 2015 00:29:12 +0000 |
| Subject: | note 117865 deleted from function.eval by googleguy | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-203419@lists.php.net to get a copy of this message | ||
Note Submitter: as8564 at gmail dot com
----
With eval enabled , attacker can easily take the control using rfi and base64_decode. For a
production website , within php.ini you must add it to disable_function list. Also it takes extra
system calls affecting the performance.