[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <73bb24ef-176d-0ea1-e0a3-5f4a9542ea50@tripleback.net>
Date: Sun, 7 May 2017 12:12:59 -0400
From: Kash Pande <kash@...pleback.net>
To: oss-security@...ts.openwall.com
Subject: Re: [white-paper] Pwning PHP mail() function For Fun
And RCE (ver 1.0)
On 03/05/17 04:32 PM, Dawid Golunski wrote:
> Here's a paper I wrote back in December. It was originally meant to go
> into Phrack but the team wanted a more general article on parameter injection
> as mail() was supposedly an outdated technique.
> Meanwhile, the RCE-chain continues :) So I decided to post it as it is without
> changing it as mail() injection deserves a separate article imho.
>
> https://exploitbox.io/paper/Pwning-PHP-Mail-Function-For-Fun-And-RCE.html
This article purposely uses a litany of poor programming practices to
expose an alleged exploit in PHP mail().. I'd like to see the same
exploit, without assuming the developer on the software had no idea what
they're doing (passing non-sanitized variables to functions). As well,
you noted in your own article that this 'discovery' was first published
in 2011 by someone else.
>
> I reveal some exim code-execution vectors in there that should change
> the whole game slightly :)
Not really, because it still relies on unfiltered input.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
