note 32281 added to function.popen

On a standard Linux/Apache/php-Configuration, this Skript takes over control as testuser (root is also possible), whose password is known as password and replaces the content of his file "file" by hallo: $process=popen("/bin/bash", "w"); fputs($process, "su testuser -c 'echo hallo>file' 2>fehler.htm\npassword\n"); fclose($process); If an error occurs, for example su is only possible from a console (seems not to be php standard configuration), the error message can be found under fehler.htm So, be aware that with a standard configuration, the php-script can do everything as root if his password is known. In such way, the password of root can also easily be found out by a dictionary-attack. ---- Manual Page -- http://www.php.net/manual/en/function.popen.php Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+32281 Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+32281&report=yes Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+32281&report=yes