New PHP Vulnerability:?-s may expose source code for mod_cgi

Post by 1SaltwaterC » Fri, May 04, 2012, 1:27 PM UTC

marklindhout wrote: post #57

wanderr wrote: post #21

As has been mentioned, using CGI for php is quite outdated so it probably doesn't impact that many sites, that said this sort of vulnerability is exactly why you should put all but the minimum front controller PHP in a folder that's outside of the public folder your site is being served from.

Absolutely not. Lighttpd and Nginx both use it, and have recently picked up a lot of popularity because of it. It maybe an old mechanism, but it is fast, which is worth something these days :)

Post by mmcnickle » Fri, May 04, 2012, 3:12 PM UTC

trevorg75 wrote: post #54

Here's a fun fact...if you try this trick on http://facebook.com/ you get the following source code include_once ' https://www.facebook.com/careers/department?dept=engineering... ;

Post by eevee » Fri, May 04, 2012, 5:32 PM UTC

ComputerGuru wrote: post #3

This vulnerability is about as bad as it gets, and my heart stopped while I was reading the intro (it's so trivially simple to compromise a site). Then I reached this sentence, which I felt needed to be bolded and underlined: A large number of sites run PHP as either an Apache module through mod_php or using php-fpm under nginx. Neither of these setups are vulnerable to this. . Thank God. That said, some blackhats ar…