8 ms·
I don't get this?
by distracteddev90 12y ago
I don't get this?
- Cymen 12y agoIt is showing example of the PHP exec call running based on a GET parameter from a request. A really big security hole. http://www.php.net/manual/en/function.exec.php http://www.php.net/manual/en/function.exec.php http://www.php.net/manual/en/reserved.variables.get.php http://www.php.net/manual/en/reserved.variables.get.php
- jamestanderson 12y agoThis shows, in a very public way, a bunch of instances where code explicitly allows for arbitrary code execution (a security no-no.)
- BHSPitMonkey 12y agoIt's a large quantity of instances of PHP code that executes arbitrary user input (URL parameters) on the server.
- patopop007 12y agoIts mean to show all the projects on Github that are vulnerable to injection attacks. An attack can maliciously create a GET request that escapes out the current command and then execute arbitrary commands.
- adamnemecek 12y agoIt's a really dumb RCE exploit. Like maybe the dumbest there can be.
- revscat 12y agoIt is executing shell commands based on what you pass in through a request parameter. Since there is no filtering going on, you could, I suppose, pass in an entire bash script and have a good ol' time.