Date: Sun, 7 May 2017 12:12:59 -0400 From: Kash Pande <kash@...pleback.net> To: oss-security@...ts.openwall.com Subject: Re: [white-paper] Pwning PHP mail() function For Fun And RCE (ver 1.0) On 03/05/17 04:32 PM, Dawid Golunski wrote: > Here's a paper I wrote back in December. It was originally meant to go > into Phrack but the team wanted a more general article on parameter injection > as mail() was supposedly an outdated technique. > Meanwhile, the RCE-chain continues :) So I decided to post it as it is without > changing it as mail() injection deserves a separate article imho. > > https://exploitbox.io/paper/Pwning-PHP-Mail-Function-For-Fun-And-RCE.html This article purposely uses a litany of poor programming practices to expose an alleged exploit in PHP mail().. I'd like to see the same exploit, without assuming the developer on the software had no idea what they're doing (passing non-sanitized variables to functions). As well, you noted in your own article that this 'discovery' was first published in 2011 by someone else. > > I reveal some exim code-execution vectors in there that should change > the whole game slightly :) Not really, because it still relies on unfiltered input.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ