6 ms·
It's a standard remote code execution exploit. It's as bad as it gets in security vulnerabilities. He is running shell commands through the Twitter server - th
by RyanZAG 12y ago
It's a standard remote code execution exploit. It's as bad as it gets in security vulnerabilities.
He is running shell commands through the Twitter server - the 'uptime' command is just a demo. He could also access privates files and possibly gain access to secure data that would let him access all data stored on Twitter servers, etc. He could also alter the twitter code to display anything he wanted to twitter users.
- xamolxix 12y ago> He could also alter the twitter code to display anything he wanted to twitter users. Maybe, maybe not, depending on the web server's permissions. Also it seems to be a subdomain which may not have the main twitter code. It's still pretty bad and embarrassing.
- Argorak 12y ago> Maybe, maybe not, depending on the web server's permissions. Also it seems to be a subdomain which may not have the main twitter code. Subdomains can run on the same server. Also, the code is uninteresting, data usually is. Also, higher permissions are just one OS exploit away. As with many exploits, it's a stepping stone, but a big one. The combination matters.