full-disclosure - flaw in php_exec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: npguy at websurfer.com.np (npguy)
Subject: flaw in php_exec_dir patch

is your safe mode on? .. whats ur platorm. 
give more details! 

On Wednesday 23 June 2004 07:05 am, VeNoMouS wrote:
> Found a issue last night while testing php_exec_dir patch
>
> if you do the following
>
> $blah=`ps aux`;
> echo nl2br($blah);
>
> php_exec_dir will block the call if you have set the exec_dir parm in php
> or apache
>
> anyway.... if you do this
>
> $blah=`;ps aux`;
> echo nl2br($blah);
>
> it bypasses the exec block and excutes the ps due to the ';', as bash
> interrupts ';' as a new cmd, ive emailed the author but no response.