|
Posted by P Pulkkinen on 01/15/07 18:45
> I do not know anything about PHP but thrown into this mix. I was told
> by my ISP that there is vulnerability in following code to allow
> spammer load an offsite php script for mailing. The defective code is:
> if (isset($HTTP_GET_VARS['sport']))
> {
> $sport = $HTTP_GET_VARS['sport'];
> require ($sport.".php");
> }
$allowable_sports= array("football", "rugby", "tennis");
if (isset($HTTP_GET_VARS['sport']) && in_array($HTTP_GET_VARS['sport'],
$allowable_sports) )
{ require ($sport.".php"); }
else
{ require ("no_sport_just_sofa.php"); }
[Back to original message]
|