[cobalt-users] [Raq4] Directory Listing Exploit found.

["Kai" <go@xxxxxxxxxxxx>]

Today I caught a user of mine exposing my client list to the world via a PHP
script that uses the opendir() and explode() function. This is just as bad
as code red. I know they can't execute anything. But a directory listing is
just as bad. They can list every directory. I looked at the webpage and
brought up a list of my sites in /home/sites.


I know what you're thinking. "This has been addressed i the archives. You
use: Options -Indexes in the access.conf file".
However... This DOES work for normal directory listing. However... PHP seems
to bypass this. It has it's own permissions or something.
So.. How do we make PHP abide by these rules too.. because this script i
have can show u anyting ;)

Thanks in advance.

Kai.