[cobalt-users] HACK !! - PHP HTTP File Editor

["Steven Depuydt - www.BeNe.WS" <Steven@xxxxxxx>]

Hello List,

I downloaded this little PHP script from the following location:
http://www.gintonyx.de/php_html_editor.html

With this script it's possible that ANY user of your server with FTP-access
(to copy the PHP-files to your server), can BRWOSE & READ the COMPLETE
directory structure of your server with his browser !!

So it's possible to VIEW/READ EVERY FILE on the server. Even the files that
are not owned by that user !!

So it's possible to view the passwords & logins of the MySQL databases in
PHP-files.
That user can hack your database and who nows what else he can find on your
server.

What can we do against this ?

THANKS FOR YOUR COMMENTS !!

Steven Depuydt


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.443 / Virus Database: 248 - Release Date: 10/01/2003