Comments (1)
Hi @wgetnz
I'm not the author of this project but rather someone testing it against my own servers and planning for it.
Personally if you are working on a project that allows users to enter PHP code then what I would recommend for something like this is a custom script that checks each condition and reports on the items that fail (or while not ideal manual testing on a single server if needed).
I'm aware of another open PHP bug that can crash servers which I've been testing. In this case if someone had 10 separate bugs and tested each condition with a single script they would not know which one takes the server down. However with a custom script that checks each script and reports one by one the error script can be determined. Same goes for the great code in the project. While it might not take a server down it allows a end-user to bypass critical security code in the standard environment which is enough to access anything on the server.
Probably most people (myself included) assume servers should be save by default but great projects like this prove otherwise so if security is a high priority, then unfortunately a lot of custom testing or scripts are typically needed.
Do you have a custom setup that allows users to enter PHP code? If so I would be curious on hearing details because code in the project can likely bypass it. There are always solutions but it takes time.
from exploits.
Related Issues (13)
- Wrong information HOT 8
- Bypass without PHP References? HOT 4
- Is it possible in "php-concat-bypass" to return back ability to... HOT 2
- I want to learn
- php-filter-bypass for 5.x
- php7-backtrace-bypass on Linux x86
- Similar to hot-patching the memory space to enable same
- Temporary fix? HOT 3
- System read
- How to avoid memory corruption? HOT 1
- Not work from apache HOT 2
- php-filter-bypass HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from exploits.