if a webprogrammer made the mistake having such code:
- Code: Select all
<?php include $_GET["page"]; ?>
and including files with
- Code: Select all
../index.php?page=start.php
then an attacker can misuse the proc file descriptors to access the error.log, since you find them in
- Code: Select all
/proc/[pidOfApache]/fd/[0-11]
and they are always 11 or less. Therefore, an attacker can simply try all of them and acess the error.log.
Why is there such an "implementation" on unixoides systems?, is this considered to be a default-vulnerability?
cheers
