3 ms·
Does anyone know if this exploit has any lasting effects? After this, you can start appending ?a=<your command> to all PHP scripts (you may need multiple r
by nucleardog 7y ago
Does anyone know if this exploit has any lasting effects?
After this, you can start appending ?a=<your command> to all PHP scripts (you may need multiple retries).
I'd love some way to confirm that my mitigations have worked and that I am no longer vulnerable but, y'know, running random slavic exploits against the server seems a bit sketchy.
- x3sphere 7y agoDidn’t look at the code that closely, but there’s an option to only test the server for the exploit. As long as that is enabled, it doesn’t appear to write any files, etc. I would say it might be better to just test against a localhost server in a VM to be on the safe side though.
- good_guy 7y agoIf you are managing a php server and asking this question then you have bigger problems.