note 95672 deleted from reserved.variables.server by cmb

Note Submitter: admin at NOSpAM dot sinfocol dot org ---- I was testing with the $_SERVER variable and some request method, and I found that with apache I can put an arbitrary method. For example, I have an script called "server.php" in my example webpage with the next code: <?php echo $_SERVER['REQUEST_METHOD']; ?> And I made this request: c:\>nc -vv www.example.com 80 example.com [x.x.x.x] 80 (http) open ArbitratyMethod /server.php HTTP/1.1 Host: wow.sinfocol.org Connection: Close The response of the server is the next: HTTP/1.1 200 OK Date: Fri, 15 Jan 2010 05:14:09 GMT Server: Apache Connection: close Transfer-Encoding: chunked Content-Type: text/html ArbitratyMethod So, be carefully when include the $_SERVER['REQUEST_METHOD'] in any script, this kind of "bug" is old and could be dangerous.