Exec($_GET
github.com
Exec($_GET
1–10 of 131 posts
Re: Exec($_GET
#2I don't get this?
Re: Exec($_GET
#3I don't get this?
It is showing example of the PHP exec call running based on a GET parameter from a request. A really big security hole.
Re: Exec($_GET
#4I don't get this?
This shows, in a very public way, a bunch of instances where code explicitly allows for arbitrary code execution (a security no-no.)
Re: Exec($_GET
#5I don't get this?
It's a large quantity of instances of PHP code that executes arbitrary user input (URL parameters) on the server.
Re: Exec($_GET
#6I don't get this?
Its mean to show all the projects on Github that are vulnerable to injection attacks. An attack can maliciously create a GET request that escapes out the current command and then execute arbitrary commands.
Re: Exec($_GET
#7I don't get this?
It's a really dumb RCE exploit. Like maybe the dumbest there can be.
Re: Exec($_GET
#8I don't get this?
It is executing shell commands based on what you pass in through a request parameter. Since there is no filtering going on, you could, I suppose, pass in an entire bash script and have a good ol' time.
Re: Exec($_GET
#9I found a legit repo for this code https://github.com/andresriancho/w3af-moth "A set of vulnerable PHP scripts used to test w3af's vulnerability detection features."
Re: Exec($_GET
#10Something like this might make a great feature for github — exploit code review warnings/alerts.