3 ms·
Indeed. If you use shared web hosting (like Bluehost) there are often hundreds of other websites running on the same server. It is trivial to write a script tha
by xinsight 16y ago
Indeed. If you use shared web hosting (like Bluehost) there are often hundreds of other websites running on the same server. It is trivial to write a script that runs with the permissions of the webserver to snoop other websites' files. Read the config files (wp-config.php in the case of Wordpress) and you can then access the database directly and wreak major havoc.
- andfarm 16y agoNote that this is only true if your host is running PHP using mod_php or similar, and they don't have safe_mode configured properly.
- xinsight 16y agoA perl script running via cgi could do it, no?
- andfarm 16y agoUnless your host is incredibly dumb and doesn't have suexec enabled [1], CGI scripts run as their owner [2]. [1] And, if they don't, you should run away. Fast. [2] The actual rules are a little more complex than that, but that's what it comes down to.