3 ms·
>nginx' configuration format leaves a lot to be desired, as evidenced by the (former, hopefully) widespread use of exploitable php calls. This has nothing to d
by meowface 12y ago
>nginx' configuration format leaves a lot to be desired, as evidenced by the (former, hopefully) widespread use of exploitable php calls.
This has nothing to do with nginx's config format at all. It's simply a vulnerability in FastCGI for PHP and the way PHP file paths are passed.
- xorcist 12y agoIt's a well documented feature that has existed since always. The vulnerability arises because the obvious way to configure this handler in nginx is to write regexps. You could just as well have handed the user a loaded gun pointed at their foot.