php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #9000 echo `cat /etc/passwd` -- bypasses open_basedir .
Submitted: 2001-01-30 07:47 UTC Modified: 2005-01-31 22:39 UTC
From: henka at isp dot org dot za Assigned:
Status: Closed Package: Safe Mode/open_basedir
PHP Version: 4.0.4pl1 OS: linux 2218
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: henka at isp dot org dot za
New email:
PHP Version: OS:

 

 [2001-01-30 07:47 UTC] henka at isp dot org dot za 
Even with open_basedir . configured in php.ini, the following bypasses it with concerning ease:

	echo `cat /etc/passwd`;

The fact that open_basedir is in force is obvious when we try fopen ("/etc/passwd", "r"), etc - ie, the expected open_basedir error pops up.

Surely this is not a bug?  If so, is there a way to disable backticks?

I'll wait for some kind of response before I send this to the usual support mailing lists.

Patches

123 (last revision 2013-05-05 04:24 UTC by 123321 at qq dot com)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-02-03 18:25 UTC] david@php.net 
safe_mode disables ``
safe_mode_exec_dir specifies a base directory for executables
disable_functions allows you to turn disable certain functions completely
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sun Jan 05 02:01:28 2025 UTC