|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2002-01-23 15:30 UTC] tozz at kijkt dot tv
Hello,
I think there is a pretty large security issue in PHP. E.g. we have 2 servers, we call server 1 'embrace', and name server 2 'kossy'.
on embrace we create a file index.php:
<? include("http://kossy/issue.php"); ?>
on kossy we create a file issue.php:
<? system($cmd); ?>
well, if we now type: http://embrace/index.php?cmd=ls we see the 'ls' output from kossy. This is the way it should be.. BUT, when we disable PHP op kossy we get a rather nasty bug (imho).
If we type http://embrace/index.php?cmd=ls again (where kossy has no PHP support) embrace includes the PHP source code from kossy and then parses the file, which will give us the 'ls' result on embrace.
This can be used for numerous attacks. And I PHP should only include parsed PHP or non-PHP files from external (http://) links.
Bye,
Tozz
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Thu Nov 06 19:00:01 2025 UTC |
We can't stop developers from shooting themselves in the foot. If you want to include a remote file without parsing it locally, you would use: readfile("http://domain.com/filename"); You could of course also just use the allow_url_fopen directive in your php.ini file if you really want to turn this off. If you removed all the functions that developers could use to shoot themselves in the foot with there wouldn't be much left to do interesting things.