[IMPORTANT] phpinfo() vulnerability

jayant

Make sure you keep your phpinfo() scripts protected (as in preferably not available for the world to see). This is no bigee, but it's best to avoid it:

http://www.securityfocus.com/bid/7805/discussion/

Example:

phpinfo.php?code=<script>alert("This is an exploit");</script>

Elizabeth

Thanks Jayant- glad to know someone's staying on top of things 🙂

-Elizabeth

jimson

anybody knows does this affect php 4.3.2
?

mystrymaster

cool thanks for the info

jayant

Originally posted by jimson
anybody knows does this affect php 4.3.2
?

Affected 4.3.2 on Windows. Didn't try linux yet

BuzzLY

Thanks for the head's up, Jayant. Good to know!

jayant

Originally posted by jayant
Affected 4.3.2 on Windows. Didn't try linux yet

Affects linux as well. just tested

jimson

oh man.... 🙁

jimson

the hosting company must be crazy now...

the_myth

I know this is making me a real n00b, but could some nice person please explain this too me?

jayant

Originally posted by the_myth
I know this is making me a real n00b, but could some nice person please explain this too me?

This is called Cross Site Scripting abbriviated often as XSS and CSS

Read the XSS FAQ for more info.

goldbug

jimson - why would the hosting company care?

Correct me if I'm wrong, but CSS/XSS only impacts the end user and possibly the application/website. As far as the server is concerned, I don't know of any way to do any damage with this. (Please, someone let me know otherwise)

jimson

jimson - why would the hosting company care?

peeps who pay to host mysql php... i don't see why they won't complain to their host...
maybe they will complain to php.net
but hosting company cannot do anything to prevent it...

somebody will be blaimed and scolded... <= 🙂 u know what i mean?

the_myth

Thanks jayant I understand a tad bit more now... so basically it's using one script to get information from another? Like cookies and other sensitive data?

jayant

Originally posted by goldbug
jimson - why would the hosting company care?

Correct me if I'm wrong, but CSS/XSS only impacts the end user and possibly the application/website. As far as the server is concerned, I don't know of any way to do any damage with this. (Please, someone let me know otherwise)

its possible to have to insert PHP/any other server side language also to do the damage. depends on case to case, whether it will suceed or not.

Bunkermaster

I'll go tell my boys. thanks for letting us know.

seby

its always been a known fact not to leave phpinfo on your server where it can be accessed by the public.

its good for new programmers, but i've always known it was a security issue.

dalecosp

Originally posted by seby
its always been a known fact not to leave phpinfo on your server where it can be accessed by the public.

its good for new programmers, but i've always known it was a security issue.

Concur. I'm paranoid re: security, I don't want anybody seeing anything that phpinfo() knows...pathnames, OS types, software versions, build dates, etc., etc...

epimeth

well, I always say that the question isn't how paranoid you are, but whether you're paranoid enough.

stolzyboy

Just because you aren't paranoid, doesn't mean that noone is watching!!!

And why is phpbuilder's info page available then.

Jstarkey???