|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: [Full-Disclosure] flaw in php_exec_dir patch
From: npguy (npguy
websurfer.com.np)
Date: Thu Jun 24 2004 - 09:47:24 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
is your safe mode on? .. whats ur platorm.
give more details!
On Wednesday 23 June 2004 07:05 am, VeNoMouS wrote:
> Found a issue last night while testing php_exec_dir patch
>
> if you do the following
>
> $blah=`ps aux`;
> echo nl2br($blah);
>
> php_exec_dir will block the call if you have set the exec_dir parm in php
> or apache
>
> anyway.... if you do this
>
> $blah=`;ps aux`;
> echo nl2br($blah);
>
> it bypasses the exec block and excutes the ps due to the ';', as bash
> interrupts ';' as a new cmd, ive emailed the author but no response.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]