2006/5/30, Philip Thompson <prthomp@xxxxxxxx>:
<?
if ($subPage = $_GET['page'])
include ("$subPage");
?>
Are you checking what the user is sending inside $_GET['page']? If not, your system is vulnerable to a remote file injection.
2006/5/30, Philip Thompson <prthomp@xxxxxxxx>:
<?
if ($subPage = $_GET['page'])
include ("$subPage");
?>
Are you checking what the user is sending inside $_GET['page']? If not, your system is vulnerable to a remote file injection.
|