RE: [cobalt-users] <PHP Off Topic>

["Jim Carey" <ozbcoz@xxxxxxxxxxxxxxxx>]

>
> I recently discovered, by accident, a small *bug*
> I wrote this file managing system, put it ont the web, and all of a
> sudden I could browse through the entire cobalt server. This could cause
> a security hazard...
>
> --Thijs Boonstra
>
Had the same thing - using PHPNuke and had a module in there that could be
passed a file name and it would display that file. No checks to see if the
file name was below document root. A kind gentleman in Russia send me a
display of my /etc/passwd file that he had sourced from this module :-)

I have since closed that hole !!

cheers

Jim Carey
www.OZbcoz.com discount domain registration
www.iluvoz.com affordable hosting services