Hello,

I have found a bug in PHP 4.01pl2 and maybe it exist in all other php versions too. A php script can read all files on the system when the read flag for everyone is set for that file. This code shows the problem:

<?
    require('../../../../../../../etc/passwd');
?>

It is not a very serious bug but by reading local files a hacker might get important information he (or she) could use to hack into the system.

Bye
Sebastian Wolfgarten