note 42116 deleted from features.remote-files by tomsommer
| From: | tomsommer@php.net | Date: | Tue, 04 May 2004 05:21:09 +0000 |
| Subject: | note 42116 deleted from features.remote-files by tomsommer | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-69184@lists.php.net to get a copy of this message | ||
Note Submitter: Unimportant
----
The above is true, but I've recently gotten attacked by a site which sent php-code back to my
server as an include, so the php wasn't already processed. I figured out a workaround already,
but it could've been not so pretty. Basically, someone can include http://badsite/fake.txt?&cmd=blahblah, and
depending on how fake.txt is constructed, your server will execute arbitrary code if configured to
do so.