note 32281 deleted from function.popen by nlopess

Note Submitter: egal at staerk dot de ---- On a standard Linux/Apache/php-Configuration, this Skript takes over control as testuser (root is also possible), whose password is known as password and replaces the content of his file "file" by hallo: $process=popen("/bin/bash", "w"); fputs($process, "su testuser -c 'echo hallo>file' 2>fehler.htm\npassword\n"); fclose($process); If an error occurs, for example su is only possible from a console (seems not to be php standard configuration), the error message can be found under fehler.htm So, be aware that with a standard configuration, the php-script can do everything as root if his password is known. In such way, the password of root can also easily be found out by a dictionary-attack.