3 ms·
I'm surprised it took this long to be found. Searching for shell_exec() and/or exec() in the source would be the first thing I'd do if looking for RCE.
by allset_ 7y ago
I'm surprised it took this long to be found. Searching for shell_exec() and/or exec() in the source would be the first thing I'd do if looking for RCE.
- shakna 7y agoWell it was eval($code); so it's even worse. Those two wouldn't show up, but you can call them if you want to!
- amatecha 7y agoThe examples they gave are just that, examples. Someone actually searching would enter a term like "eval(" so as to find usage of that function, regardless of what the actual arguments were